5 ms·
It's simple: allowing sandboxed code to request limited access to a USB device is more secure than having users install native, unsandboxed code with access to
by Ajedi32 9y ago
It's simple: allowing sandboxed code to request limited access to a USB device is more secure than having users install native, unsandboxed code with access to everything on their PC.
- tedunangst 9y agoAssuming the sandbox works. If the sandbox is porous, the attack surface balloons from apps I choose to install to every link I click.
- Ajedi32 9y agoNot every link you click. Only sites that you grant access to the necessary attack surface. The Web USB API can't be attacked by sites that you haven't granted access to it.
- codedokode 9y agoWhat if that privileged website has XSS vulnerability?
- Ajedi32 9y agoThen the attacker gets access to that USB device. (And only that USB device.) What if your unsandboxed native USB utility has an RCE vulnerability?
- Sir_Cmpwn 9y agohttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium
- Ajedi32 9y agoAs opposed to native desktop apps, which get all the same permissions by default that a web app requires a zero-day sandbox escape vulnerability to achieve?
- Sir_Cmpwn 9y agoNative desktop apps are limited in number are nowhere near the dumpster fire the web is. My desktop isn't routinely downloading and executing payloads from the web. They're clearly different.
- Ajedi32 9y agoThis is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw). It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to your PC and execute it? Or execute some JS in the browser sandbox and grant it limited access to that one specific device?
- Sir_Cmpwn 9y ago>if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.
- Spivak 9y agoAttaching a bootable USB drive to a HTML5 based KVM? Sure it could be accomplished in other ways buy why not this way?
- Sir_Cmpwn 9y agoWhy an HTML5 based KVM? A desktop app would be great for that!
- Ajedi32 9y agoThen click "deny", or (in the case of a native app) refuse to install the executable. Either way you're safe. For those that _do_ require [such use cases][1] though; they can now do so without needing to expose their system to an unsandboxed native app. [1]: https://wicg.github.io/webusb/#motivating-applications https://wicg.github.io/webusb/#motivating-applications