5 ms·

So I see a lot of negative comments about the security implications of this. Presuming that the browser gates access to USB devices in the same way it gates acc

So I see a lot of negative comments about the security implications of this. Presuming that the browser gates access to USB devices in the same way it gates access to geolocation, what's the risk here? How is it different than installing 3rd party software on your OS? I've read about the "inner platform" effect, and I don't know. I'm just not convinced it's a bad thing here. For all its warts, the web is far and away the best cross platform application delivery system. Use this in conjunction with things like IPFS and browser based persistent storage, and can run signed versions of trusted, auditable code that can do lots of awesome stuff. Without users having to futz with installers. What am I missing?

Klathmon 11y ago
I'd like to know too, because I just can't accept that the answer to security issues is just "Don't do that"... It really looks like they are doing this right. Fully behind permissions that are already protected against clickjacking, very limited scope, requires HTTPS, and is being implemented with security as a first priority. People are acting like access to USB is something that no PC should ever do...
- crazyhatfish 11y ago
  At the moment, nothing in a browser is direct access. Everything is abstracted, which includes the filesystem and geolocation. This provides a layer of security against massive horrible bugs in the OS. With WebUSB there seems to be very little abstracting, all the values you pass to it are then sent on to the device. Small bugs once protected by numerous layers of security usually requiring superuser abilities are now made massive as they are connected to one of the largest fuzzers there is, the internet.
userbinator 11y ago
Presuming that the browser gates access to USB devices in the same way it gates access to geolocation, what's the risk here? How is it different than installing 3rd party software on your OS? Except that most people will easily dismiss the "are you sure" warnings to the point that I could see browser developers eventually defaulting that to enabled and not asking ("it's for better UX!") The desktop is unfortunately moving in a similar direction (witness all the telemetry in Windows 10, etc.) but there at least seems to be a greater notion of user control than with what browsers are turning into.
- deleted 11y ago
  [deleted]
- Klathmon 11y ago
  Are there any examples of that happening on the web yet? All browser vendors agree that most of these new features need to be behind explicit permissions. Hell people are still complaining about full screen permissions pop-ups and no browser has gotten rid of them yet because they know the problems that could come from it. If anything there is a push to go the other direction, making previously "enabled by default" things behind permissions.
  - userbinator 11y ago
    It's really just a general trend of removing and/or hiding things that might be useful for the user to make a decision of what to do: https://news.ycombinator.com/item?id=7677898 https://news.ycombinator.com/item?id=7677898 https://news.ycombinator.com/item?id=5968237 https://news.ycombinator.com/item?id=5968237 You're right that they're (ostensibly) placing emphasis on permissions at the moment, but I don't see that staying the same if websites start adopting and using these features in any quantity.
    - deleted 11y ago
      [deleted]
  - kuschku 11y ago
    > Are there any examples of that happening on the web yet? All browser vendors agree that most of these new features need to be behind explicit permissions. Well, WebRTC is enabled by default. Exposes your real IP, and allows anyone to portscan your whole LAN.
    - Klathmon 11y ago
      WebRTC never had permissions so that's not an example of a feature that had its permissions removed after a time. And that was actually the feature I had in mind in my last paragraph. There is a pretty big push to put it behind a permissions window (at least for local network access).
coldtea 11y ago
>How is it different than installing 3rd party software on your OS? The whole act of downloading and installing? For desktop apps, you have to do that. For webapps, you just have to visit a page (or even not, thanks to XSS). And while we install 2-5 or maybe 20 apps per year (at most, some don't install anything after they get their PCs), we visit 100s of pages each day, and 1000s each month. Also, while we can realistically restrict our app downloads to legitimate sources (the App Store, the product's webpage etc), we read stuff from all over the place -- that's what links are there for.
- icebraining 11y ago
  Visit a page, and then allow it to connect to our USB devices.
MichaelGG 11y ago
Look at WebRTC for an example. Despite having zero convincing scenarios where silent P2P data channels that discard your explicit networking (proxy) settings, that's turned on in all browsers. Fun conversation: I asked someone involved with WebRTC for a real, non-video example, and they honestly suggested "maybe your browser wants to talk to your fridge and would benefit from data channel encryption". So far out of touch with reality. Wouldn't surprise me in the least if, for instance, this ends up allowing enumeration by default or something else.
makomk 11y ago
The difference is that we don't allow websites to install third party software on your OS just by convincing the user to click yes on a dialog box - not anymore, not after what happened with ActiveX. Also, it's probably not obvious to most users that giving a website access to an innocent-looking USB device is in fact equivalent to giving it full access to their PC.

Klathmon 11y ago

I'd like to know too, because I just can't accept that the answer to security issues is just "Don't do that"... It really looks like they are doing this right. Fully behind permissions that are already protected against clickjacking, very limited scope, requires HTTPS, and is being implemented with security as a first priority. People are acting like access to USB is something that no PC should ever do...

crazyhatfish 11y ago
At the moment, nothing in a browser is direct access. Everything is abstracted, which includes the filesystem and geolocation. This provides a layer of security against massive horrible bugs in the OS. With WebUSB there seems to be very little abstracting, all the values you pass to it are then sent on to the device. Small bugs once protected by numerous layers of security usually requiring superuser abilities are now made massive as they are connected to one of the largest fuzzers there is, the internet.

userbinator 11y ago

Presuming that the browser gates access to USB devices in the same way it gates access to geolocation, what's the risk here? How is it different than installing 3rd party software on your OS? Except that most people will easily dismiss the "are you sure" warnings to the point that I could see browser developers eventually defaulting that to enabled and not asking ("it's for better UX!") The desktop is unfortunately moving in a similar direction (witness all the telemetry in Windows 10, etc.) but there at least seems to be a greater notion of user control than with what browsers are turning into.

deleted 11y ago
[deleted]
Klathmon 11y ago
Are there any examples of that happening on the web yet? All browser vendors agree that most of these new features need to be behind explicit permissions. Hell people are still complaining about full screen permissions pop-ups and no browser has gotten rid of them yet because they know the problems that could come from it. If anything there is a push to go the other direction, making previously "enabled by default" things behind permissions.
- userbinator 11y ago
  It's really just a general trend of removing and/or hiding things that might be useful for the user to make a decision of what to do: https://news.ycombinator.com/item?id=7677898 https://news.ycombinator.com/item?id=7677898 https://news.ycombinator.com/item?id=5968237 https://news.ycombinator.com/item?id=5968237 You're right that they're (ostensibly) placing emphasis on permissions at the moment, but I don't see that staying the same if websites start adopting and using these features in any quantity.
  - deleted 11y ago
    [deleted]
- kuschku 11y ago
  > Are there any examples of that happening on the web yet? All browser vendors agree that most of these new features need to be behind explicit permissions. Well, WebRTC is enabled by default. Exposes your real IP, and allows anyone to portscan your whole LAN.
  - Klathmon 11y ago
    WebRTC never had permissions so that's not an example of a feature that had its permissions removed after a time. And that was actually the feature I had in mind in my last paragraph. There is a pretty big push to put it behind a permissions window (at least for local network access).

coldtea 11y ago

>How is it different than installing 3rd party software on your OS? The whole act of downloading and installing? For desktop apps, you have to do that. For webapps, you just have to visit a page (or even not, thanks to XSS). And while we install 2-5 or maybe 20 apps per year (at most, some don't install anything after they get their PCs), we visit 100s of pages each day, and 1000s each month. Also, while we can realistically restrict our app downloads to legitimate sources (the App Store, the product's webpage etc), we read stuff from all over the place -- that's what links are there for.

icebraining 11y ago
Visit a page, and then allow it to connect to our USB devices.

MichaelGG 11y ago

Look at WebRTC for an example. Despite having zero convincing scenarios where silent P2P data channels that discard your explicit networking (proxy) settings, that's turned on in all browsers. Fun conversation: I asked someone involved with WebRTC for a real, non-video example, and they honestly suggested "maybe your browser wants to talk to your fridge and would benefit from data channel encryption". So far out of touch with reality. Wouldn't surprise me in the least if, for instance, this ends up allowing enumeration by default or something else.

makomk 11y ago

The difference is that we don't allow websites to install third party software on your OS just by convincing the user to click yes on a dialog box - not anymore, not after what happened with ActiveX. Also, it's probably not obvious to most users that giving a website access to an innocent-looking USB device is in fact equivalent to giving it full access to their PC.