Right, there are effectively only two levels of trust for a typical user: None at all, and Unlimited. Do you really like that model? That model doesn't work to

Right, there are effectively only two levels of trust for a typical user: None at all, and Unlimited. Do you really like that model? That model doesn't work too well for me, I'll give you an example. I want to be able to buy a fun USB gadget (like a fitness tracker) and not have to think about the security implications, but that is difficult right now. I have two choices, I can install the manufacturers sync software, giving it unlimited access to my computer or not use it at all. I trust the manufacturer to access the device they sold me...but I don't really want to give them access to my SSH keys, so my only option is to not use it. The idea that WebUSB will allow me to visit gadgetvendor.com, grant access to one specific device, and not have to worry about any consequences is really appealing to me. They will have no access to my computer other than to the the device they sold me. I think the concerns I've read mostly boil down to "what if a website tricks me into granting access to a device I shouldn't have?". It's certainly true we need security UX experts to make sure this is not confusing, but I don't really see how that is any different than a website tricking you into running an EXE.