> The user isn't consenting to that. AFAIK webUSB was always behind a consent dialog. That attack was based on getting consent, and the authors seems to say so

> The user isn't consenting to that. AFAIK webUSB was always behind a consent dialog. That attack was based on getting consent, and the authors seems to say so at a talk about it (or a similar attack): https://www.youtube.com/watch?v=pUa6nWWTO4o https://www.youtube.com/watch?v=pUa6nWWTO4o It's still very bad, but not nearly as bad as you say it is.