26 ms·

WebUSB sounds like a truly gaping security hole. Imagine exploiting USB drivers over the web (yes, even though USB doesn't require DMA support, the drivers oper

by nimish 7y ago

WebUSB sounds like a truly gaping security hole. Imagine exploiting USB drivers over the web (yes, even though USB doesn't require DMA support, the drivers operate on a very low level -- https://security.stackexchange.com/questions/118854/attacks-via-physical-access-to-usb-dma https://security.stackexchange.com/questions/118854/attacks-...). WebGPU is more useful but direct access to hardware that could have coherent memory access/DMA is just irresponsible. Chrome needs it for chromebooks. Not sure why it's needed for less constrained machines.

VoxPelli 7y ago
Did you read this? https://wicg.github.io/webusb/#security-and-privacy https://wicg.github.io/webusb/#security-and-privacy Maybe give feedback here? https://github.com/WICG/webusb/issues/ https://github.com/WICG/webusb/issues/
- BoorishBears 7y ago
  I did literally last night (what a happy coincidence!) and it gave me a great laugh "We identified the biggest security problem with this, but to get adoption we're going to rely on prompts (which we all know users pay attention to)" Then the next section is: "We know how the previous shortcomings can be exploited to pwn the host too, hosts, don't let yourselves get pwn'd k thnx" What feedback is there to give, they know what's wrong, they just don't care.
  - VoxPelli 7y ago
    Longer related thread: https://github.com/w3ctag/design-reviews/issues/108 https://github.com/w3ctag/design-reviews/issues/108
    - BoorishBears 7y ago
      Isn't that a play by play of exactly what I described?
- nimish 7y ago
  It's up to them to prove that WebUSB is secure, not on me to prove it's insecure. Direct hardware access over the web is inherently dangerous. If they have a way of truly sandboxing malicious uses, without entering into permissions request overload (no human is infallible), I'd love to hear it. the "discussed at X f2f" is not filling me with confidence.
zamadatix 7y ago
There are 2 worlds on the web, what a page can access simply by going to it and what a page can access when you grant it permissions after it asks. The latter is where WebUSB falls, I call it the realm of the web app, and is no more risky (arguably less due to design) than the current "do you want to download and run nativeusbapp.exe" permission.
- JohnFen 7y ago
  > is no more risky (arguably less due to design) than the current "do you want to download and run nativeusbapp.exe" permission. I'm nervous about justifying one thing based on the fact that a different, objectively terrible, thing is allowed already.
  - vbezhenar 7y ago
    What's so terrible about using USB devices? I have my crypto token with USB interface and I'm using it to interact with website. The only alternative is to store private key in file and it's worse.
    - JohnFen 7y ago
      The terrible thing I was referring to was the prompt asking users if they want to execute a binary they just downloaded.
- viraptor 7y ago
  It moves the target for user education yet again though. You know how we get the "allow notifications" popup everywhere now? Recently someone spotted a page which tries "to verify you're human, click allow on the notification". If we spam users with requests like that and lose control of simple things, there's no chance for us to ask a meaningful question about webusb. I've seen this on my mom's mobile phone. It's full of news notifications that annoy her - because she defaulted to clicking "allow", because she's a typical user.
  - 7y ago
VoxPelli 7y ago
Mozilla agrees with you: https://mozilla.github.io/standards-positions/#webusb https://mozilla.github.io/standards-positions/#webusb
- VoxPelli 7y ago
  And here's a PR for adding that to CanIUse: https://github.com/Fyrd/caniuse/pull/5262 https://github.com/Fyrd/caniuse/pull/5262
reaperducer 7y ago
WebUSB sounds like a truly gaping security hole "Greetings, Rando Middle Manager. Your cousin Larry has been arrested by police in Elbonia. Please to pay US$500,000 into this Bitcoin account to free hime. Or if you do not have funds, plug in company secure USB drive and click OK."

by nimish 7y ago

VoxPelli 7y ago

Did you read this? https://wicg.github.io/webusb/#security-and-privacy https://wicg.github.io/webusb/#security-and-privacy Maybe give feedback here? https://github.com/WICG/webusb/issues/ https://github.com/WICG/webusb/issues/

BoorishBears 7y ago
I did literally last night (what a happy coincidence!) and it gave me a great laugh "We identified the biggest security problem with this, but to get adoption we're going to rely on prompts (which we all know users pay attention to)" Then the next section is: "We know how the previous shortcomings can be exploited to pwn the host too, hosts, don't let yourselves get pwn'd k thnx" What feedback is there to give, they know what's wrong, they just don't care.
- VoxPelli 7y ago
  Longer related thread: https://github.com/w3ctag/design-reviews/issues/108 https://github.com/w3ctag/design-reviews/issues/108
  - BoorishBears 7y ago
    Isn't that a play by play of exactly what I described?
nimish 7y ago
It's up to them to prove that WebUSB is secure, not on me to prove it's insecure. Direct hardware access over the web is inherently dangerous. If they have a way of truly sandboxing malicious uses, without entering into permissions request overload (no human is infallible), I'd love to hear it. the "discussed at X f2f" is not filling me with confidence.

zamadatix 7y ago

There are 2 worlds on the web, what a page can access simply by going to it and what a page can access when you grant it permissions after it asks. The latter is where WebUSB falls, I call it the realm of the web app, and is no more risky (arguably less due to design) than the current "do you want to download and run nativeusbapp.exe" permission.

JohnFen 7y ago
> is no more risky (arguably less due to design) than the current "do you want to download and run nativeusbapp.exe" permission. I'm nervous about justifying one thing based on the fact that a different, objectively terrible, thing is allowed already.
- vbezhenar 7y ago
  What's so terrible about using USB devices? I have my crypto token with USB interface and I'm using it to interact with website. The only alternative is to store private key in file and it's worse.
  - JohnFen 7y ago
    The terrible thing I was referring to was the prompt asking users if they want to execute a binary they just downloaded.
viraptor 7y ago
It moves the target for user education yet again though. You know how we get the "allow notifications" popup everywhere now? Recently someone spotted a page which tries "to verify you're human, click allow on the notification". If we spam users with requests like that and lose control of simple things, there's no chance for us to ask a meaningful question about webusb. I've seen this on my mom's mobile phone. It's full of news notifications that annoy her - because she defaulted to clicking "allow", because she's a typical user.
- 7y ago

VoxPelli 7y ago

Mozilla agrees with you: https://mozilla.github.io/standards-positions/#webusb https://mozilla.github.io/standards-positions/#webusb

VoxPelli 7y ago
And here's a PR for adding that to CanIUse: https://github.com/Fyrd/caniuse/pull/5262 https://github.com/Fyrd/caniuse/pull/5262

reaperducer 7y ago

WebUSB sounds like a truly gaping security hole "Greetings, Rando Middle Manager. Your cousin Larry has been arrested by police in Elbonia. Please to pay US$500,000 into this Bitcoin account to free hime. Or if you do not have funds, plug in company secure USB drive and click OK."