5 ms·

I didn’t see any security features mentioned… am I the only one a wee bit terrified? Am I just paranoid?

by monkellipse 5y ago

monocasa 5y ago
There's explicit dialogs the user has to opt into.
- est31 5y ago
  Most (>80%) of users are highly computer illiterate. Even among younger folks. There has recently been a story on hn about zoomers not "understanding" how file systems work.
  - monocasa 5y ago
    Statistically they have a lesser understanding of hierarchical filesystems, because Apple and to a lesser degree Google have been going out of their way to hide that on mobile OSes for some reason that was never really clear to me. They still understand files though. And at the end of the day there's only so much you can do. The same kind of people that will click yes on any dialog will also click yes on "do you want to run this exe you just downloaded", and that'll get you file system access just fine too.
    - est31 5y ago
      Yeah hierarchical file systems are not the one true way to organize your data. But from my understanding, the user grants access via this API on a directory based level when the website asks for access to one directory. If you have no concept of directories, or you put everything directly into one directory, it's tough to make this restriction useful. So in this instance, knowledge of hierarchical file systems is relevant, even if new operating systems make this knowledge increasingly obsolete.
      - monocasa 5y ago
        > Yeah hierarchical file systems are not the one true way to organize your data. It's the way nearly all computers, mobile or not, organize data. Some hide this fact to because they either think they know better than the user (Apple) or they want to make it really painful to not store all of your data in their backend (Google). > But from my understanding, the user grants access via this API on a directory based level when the website asks for access to one directory. If you have no concept of directories, or you put everything directly into one directory, it's tough to make this restriction useful. So in this instance, knowledge of hierarchical file systems is relevant, even if new operating systems make this knowledge increasingly obsolete. I think that illiteracy here has more to do with the advent of mobile OSes and people only exposed to mobile devices. Filesystem access isn't supported on mobile browsers at all so there isn't really a problem there (except for mobile Safari, which also doesn't expose folders to users, being on Apple's direct control). https://caniuse.com/native-filesystem-api https://caniuse.com/native-filesystem-api
  - tshaddox 5y ago
    If you’re concerned about users having literally no floor to their technical understanding or awareness, then those users are already vulnerable to websites with a form that says “type your Gmail address and password here.”
- hulitu 5y ago
  You mean like in Android ? Where you give an app access to all your files ?
nekcihc 5y ago
I remember some time ago Firefox denied all the local access as a security issue - despite all the dialogs that asked for rights. Had to find some other ways to access simple txt file - via link.
- cmeacham98 5y ago
  Firefox never has implemented the filesystem access API: https://caniuse.com/native-filesystem-api https://caniuse.com/native-filesystem-api
  - iggldiggl 5y ago
    They didn't even want to give extensions that kind of capabilities (and in the process significantly crippled mass downloaders like DownThemAll and others), so yeah…
  - nekcihc 5y ago
    I was refering to ability to manipulate local files from Firefox, that existed 6 - maybe 8 years ago - long long time ago, when this filesystem API did not exist.

I didn’t see any security features mentioned… am I the only one a wee bit terrified? Am I just paranoid?

monocasa 5y ago

There's explicit dialogs the user has to opt into.

est31 5y ago
Most (>80%) of users are highly computer illiterate. Even among younger folks. There has recently been a story on hn about zoomers not "understanding" how file systems work.
- monocasa 5y ago
  Statistically they have a lesser understanding of hierarchical filesystems, because Apple and to a lesser degree Google have been going out of their way to hide that on mobile OSes for some reason that was never really clear to me. They still understand files though. And at the end of the day there's only so much you can do. The same kind of people that will click yes on any dialog will also click yes on "do you want to run this exe you just downloaded", and that'll get you file system access just fine too.
  - est31 5y ago
    Yeah hierarchical file systems are not the one true way to organize your data. But from my understanding, the user grants access via this API on a directory based level when the website asks for access to one directory. If you have no concept of directories, or you put everything directly into one directory, it's tough to make this restriction useful. So in this instance, knowledge of hierarchical file systems is relevant, even if new operating systems make this knowledge increasingly obsolete.
    - monocasa 5y ago
      > Yeah hierarchical file systems are not the one true way to organize your data. It's the way nearly all computers, mobile or not, organize data. Some hide this fact to because they either think they know better than the user (Apple) or they want to make it really painful to not store all of your data in their backend (Google). > But from my understanding, the user grants access via this API on a directory based level when the website asks for access to one directory. If you have no concept of directories, or you put everything directly into one directory, it's tough to make this restriction useful. So in this instance, knowledge of hierarchical file systems is relevant, even if new operating systems make this knowledge increasingly obsolete. I think that illiteracy here has more to do with the advent of mobile OSes and people only exposed to mobile devices. Filesystem access isn't supported on mobile browsers at all so there isn't really a problem there (except for mobile Safari, which also doesn't expose folders to users, being on Apple's direct control). https://caniuse.com/native-filesystem-api https://caniuse.com/native-filesystem-api
- tshaddox 5y ago
  If you’re concerned about users having literally no floor to their technical understanding or awareness, then those users are already vulnerable to websites with a form that says “type your Gmail address and password here.”
hulitu 5y ago
You mean like in Android ? Where you give an app access to all your files ?

nekcihc 5y ago

I remember some time ago Firefox denied all the local access as a security issue - despite all the dialogs that asked for rights. Had to find some other ways to access simple txt file - via link.

cmeacham98 5y ago
Firefox never has implemented the filesystem access API: https://caniuse.com/native-filesystem-api https://caniuse.com/native-filesystem-api
- iggldiggl 5y ago
  They didn't even want to give extensions that kind of capabilities (and in the process significantly crippled mass downloaders like DownThemAll and others), so yeah…
- nekcihc 5y ago
  I was refering to ability to manipulate local files from Firefox, that existed 6 - maybe 8 years ago - long long time ago, when this filesystem API did not exist.