61–70 of 113 posts
What is the usecase for WebUSB? Here [1] someone from Google suggests vendors should write device drivers in Chrome HTML and Chrome Javascript. Please don't. Or (my assuption) it might be for devices that cannot work without browser and network connection. [1] https://developers.google.com/web/updates/2016/03/access-usb...
What is the usecase for WebUSB? Here [1] someone from Google suggests vendors should write device drivers in Chrome HTML and Chrome Javascript. Please don't. Or (my assuption) it might be for devices that cannot work without browser and network connection. [1] https://developers.google.com/web/updates/2016/03/access-usb...
Well, we found it really, really useful! https://www.numworks.com/blog/webusb-firmware-update/
It's almost as if browsers are slowing reinventing Java applets while ignoring all of the security implications that go along with it.
They're slowly inventing operating systems, complete with hypervisor technology, with all the gargantuan complexity that it implies, to please big business that wants the client OS to essentially become obsolete.
Earlier quoted context omitted.
I'm not that confident. Browsers blindly accept and execute whatever they receive. The more features that get added, the larger surface there is to exploit. A case in point: WebUSB as mentioned in the article.
The nice thing though is that, although the added attack surface is there, its not really accessible to web pages until a user grants the necessary permissions. Not really all that different from telling users to execute a native app in that respect. In this case it's not even an exploit really; more like social engineering. (Tricking users into granting the phishing site unrestricted access to their Yubikey, then us…
Earlier quoted context omitted.
> - Don't use U2F because FireFox doesn't support it It does! Open about:config and switch security.webauth.u2f to true. It'll Just Work. I've in the recent past modified a barebones Perl webapp to try and understand U2F better, see https://u2fdemo.darkpan.com/ I've been able to log in / use U2F from: * FF on Windows and OSX * Chrome on Windows, OSX * Chrome on Android using either a OTG cable for a U2F USB key, a Bl…
Firefox barely supports U2F. It works on Github and Dropbox, but doesn't work on sites like Vanguard and Google. Every time I do a Firefox update I do a search of the bug listing and they seem to have an incomplete implementation of the spec. They're kicking the can until they fully implement the WebAuth API and jump over dealing with whatever earlier spec they were targeting. Speaking of which, why does Vanguard for…
Firefox is compliant.
This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
The existence of WebUSB is awful. Why anyone ever thought it was a good idea to let JavaScript touch your USB devices is beyond me.
I think WebUSB will enable a lot of cool things, though it will definitely be hard to sandbox.
I want to program an Arduino from a web IDE. I want to control a 3d printer or pen plotter from a web application. I want to store things on a flash drive on my iPhone using a web-based file explorer? This last one sounds strange.
On a tangent, I see application runtimes moving into the browser by default with very few performance-critical applications remaining outside that stack. Photoshop and AAA games might be exceptions. Services like databases and web browsers would not have a need to be in Chrome.
(don't hurt me, I know I'm strange.. ~)
Earlier quoted context omitted.
The existence of WebUSB is awful. Why anyone ever thought it was a good idea to let JavaScript touch your USB devices is beyond me.
Strongly disagree here. I think WebUSB will enable a lot of cool things, though it will definitely be hard to sandbox. I want to program an Arduino from a web IDE. I want to control a 3d printer or pen plotter from a web application. I want to store things on a flash drive on my iPhone using a web-based file explorer? This last one sounds strange. On a tangent, I see application runtimes moving into the browser by de…
Earlier quoted context omitted.
The existence of WebUSB is awful. Why anyone ever thought it was a good idea to let JavaScript touch your USB devices is beyond me.
Strongly disagree here. I think WebUSB will enable a lot of cool things, though it will definitely be hard to sandbox. I want to program an Arduino from a web IDE. I want to control a 3d printer or pen plotter from a web application. I want to store things on a flash drive on my iPhone using a web-based file explorer? This last one sounds strange. On a tangent, I see application runtimes moving into the browser by de…
EG, take a few seconds to turn on a flag in configuration, or add a plugin.
Earlier quoted context omitted.
Strongly disagree here. I think WebUSB will enable a lot of cool things, though it will definitely be hard to sandbox. I want to program an Arduino from a web IDE. I want to control a 3d printer or pen plotter from a web application. I want to store things on a flash drive on my iPhone using a web-based file explorer? This last one sounds strange. On a tangent, I see application runtimes moving into the browser by de…
Why do you want to use a Web IDE? I am not trying to cause tension, I am just genuinely curious.
Getting 400 students up and running with python is painful alone - without USB. For projects, some small fraction of those used USB, and we again had a pretty good chunk of time spent getting them all working.
Earlier quoted context omitted.
> - Don't use U2F because FireFox doesn't support it It does! Open about:config and switch security.webauth.u2f to true. It'll Just Work. I've in the recent past modified a barebones Perl webapp to try and understand U2F better, see https://u2fdemo.darkpan.com/ I've been able to log in / use U2F from: * FF on Windows and OSX * Chrome on Windows, OSX * Chrome on Android using either a OTG cable for a U2F USB key, a Bl…
It works, but only partially, and is still very very broken, which is why it is disabled in the first place. See also this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1065729