3 ms·

Hmm I don't understand bluetooth protocol well. What are some security issues I should be aware of if a rando site ask for bluetooth permissions(assuming this f

by rawnlq 10y ago

Hmm I don't understand bluetooth protocol well. What are some security issues I should be aware of if a rando site ask for bluetooth permissions(assuming this feature is gated) and I accidentally click yes? Will it be able to take over bluetooth speakers or robot toys? They must be in discovery mode for it to connect so I am safe right? Then it will just be privacy issues which I can live with. Otherwise it looks pretty cool. E.g, controlling a drone from a webpage: https://www.youtube.com/watch?v=gXu3G3cg52k&feature=youtu.be https://www.youtube.com/watch?v=gXu3G3cg52k&feature=youtu.be

woodruffw 10y ago
At a glance, here are some issues: Every bluetooth device has a unique MAC-like address, which could be used to track you (or your device, at least). There are also obvious privacy/security issues with the fact that device-stored information (full name, location, biostatistics, etc) can be accessed by any JS loaded onto the same page (read: analytics companies). The whole Web Bluetooth spec is online[0], if you'd like to read it for yourself. [0]: https://webbluetoothcg.github.io/web-bluetooth/ https://webbluetoothcg.github.io/web-bluetooth/
robwormald 10y ago
https://developers.google.com/web/updates/2015/07/interact-with-ble-devices-on-the-web https://developers.google.com/web/updates/2015/07/interact-w... is a good primer on the API, and a links to security explainer: https://medium.com/@jyasskin/the-web-bluetooth-security-model-666b4e7eed2#.kkts54677 https://medium.com/@jyasskin/the-web-bluetooth-security-mode...
m_eiman 10y ago
I'm most concerned that this will make it feasible to perform rogue firmware upgrades to vulnerable devices that previously were protected by not being connected to the Internet, turning them into various kinds of surveillance and denial-of-service bots…
MrQuincle 10y ago
I have already been playing with this as a manufacturer of BLE power switches. It does allow for cross-platform BLE access leveraging JavaScript in the browser. The experience of someone gives permanent access is similar to running an app on a phone. This means you can do a scan request from the browser and all BLE devices respond. Or you can silently listen to advertisements. I don't think you can only give access to particular devices and for example hide the fact that you have a Fitbit or Apple watch. For smart home applications it is cool for configuration but not for daily use. You don't want anything rely on the user opening up a browser. Apps much more naturally run in the background so the downtime of the browser is a serious hurdle. Every day I'm shocked by new BLE devices coming in that leak information or are improperly protected. I would only give permissions to sites that you would definitely trust with this. Something that can come out of this is better attention to multi-device access to BLE devices. Keys that are set up for bonding can not be shared easily with other users. Apple brings its usual Apple-only solution in the form of Homekit, but it would be better to have keys that can be shared across platforms. If the browser becomes also a player this is gonna be important.

by rawnlq 10y ago

woodruffw 10y ago

At a glance, here are some issues: Every bluetooth device has a unique MAC-like address, which could be used to track you (or your device, at least). There are also obvious privacy/security issues with the fact that device-stored information (full name, location, biostatistics, etc) can be accessed by any JS loaded onto the same page (read: analytics companies). The whole Web Bluetooth spec is online[0], if you'd like to read it for yourself. [0]: https://webbluetoothcg.github.io/web-bluetooth/ https://webbluetoothcg.github.io/web-bluetooth/

robwormald 10y ago

https://developers.google.com/web/updates/2015/07/interact-with-ble-devices-on-the-web https://developers.google.com/web/updates/2015/07/interact-w... is a good primer on the API, and a links to security explainer: https://medium.com/@jyasskin/the-web-bluetooth-security-model-666b4e7eed2#.kkts54677 https://medium.com/@jyasskin/the-web-bluetooth-security-mode...

m_eiman 10y ago

I'm most concerned that this will make it feasible to perform rogue firmware upgrades to vulnerable devices that previously were protected by not being connected to the Internet, turning them into various kinds of surveillance and denial-of-service bots…

MrQuincle 10y ago

I have already been playing with this as a manufacturer of BLE power switches. It does allow for cross-platform BLE access leveraging JavaScript in the browser. The experience of someone gives permanent access is similar to running an app on a phone. This means you can do a scan request from the browser and all BLE devices respond. Or you can silently listen to advertisements. I don't think you can only give access to particular devices and for example hide the fact that you have a Fitbit or Apple watch. For smart home applications it is cool for configuration but not for daily use. You don't want anything rely on the user opening up a browser. Apps much more naturally run in the background so the downtime of the browser is a serious hurdle. Every day I'm shocked by new BLE devices coming in that leak information or are improperly protected. I would only give permissions to sites that you would definitely trust with this. Something that can come out of this is better attention to multi-device access to BLE devices. Keys that are set up for bonding can not be shared easily with other users. Apple brings its usual Apple-only solution in the form of Homekit, but it would be better to have keys that can be shared across platforms. If the browser becomes also a player this is gonna be important.