4 ms·

To be fair, you're supposed to get a permission dialog and it seems you have to pick the specific device(s) to connect to them. https://web.dev/usb/#get-access

To be fair, you're supposed to get a permission dialog and it seems you have to pick the specific device(s) to connect to them. https://web.dev/usb/#get-access-to-usb-devices https://web.dev/usb/#get-access-to-usb-devices However I suppose that the mere existence of this API means that there could be a way to bypass the request; The browser already does have full access to every device.

mschuster91 4y ago
Sweet jesus that's easy. Wonder if stuff like Samsung ODIN (which already has a OSS clone) could be ported to that.
- selfhoster11 4y ago
  Web MiniDisc folks ported the reverse-engineered the NetMD protocol tools to JS, and can now upload audio and patch device firmware on any MD device connected via Chrome/Chromium. Porting Odin is likely to be feasible.
- rany_ 4y ago
  Has been done with https://github.com/kdrag0n/fastboot.js https://github.com/kdrag0n/fastboot.js, might be feasible with Odin as well..
- kevingadd 4y ago
  I believe the device also needs to be WebUSB compatible, unless that part of the design changed - it's a measure to reduce the attack surface by not letting webpages talk to old pre-WebUSB hardware that might have vulnerabilities.
  - TobTobXX 4y ago
    If I'be read it correctly it _can_ announce itself over WebUSB. And I suppose this announcement contains a landing URL, which Chrome will then show upon plug-in of the device. So device-side WebUSB capability seems like a feature, rather than a requirement for browser-side communication.
    - selfhoster11 4y ago
      It’s certainly not a requirement for the device to support WebUSB. NetMD recorders were created long before WebUSB, but can still be used from a browser app.
- jeroenhd 4y ago
  Definitely possible, especially with native-to-WASM tooling. I've used a web page to run ADB commands to quickly debloat my phone, so I don't see why fastboot support wouldn't work. There's even a tool to flash your Android phone through the browser (https://pixelrepair.withgoogle.com/ https://pixelrepair.withgoogle.com/ I believe). Adding "automated LineageOS installer through WebUSB" to my infinitely growing to-do list :)
  - intelVISA 4y ago
    That sounds great, I hope you pursue it. Do you know of any specific risks when flashing devices w/ WebUSB as opposed to the 'normal' way?
    - mschuster91 4y ago
      With Google's devices I think and hope that the code accounts both on the web side and the device firmware side for interrupted communications or latency due to whatever external factors (e.g. another page that is running in the same execution context sending the single JS thread into a loop or lock). With non-Google devices... these might run into problems when the device expects a certain response latency or minimum bandwidth. YMMV I'd say.

mschuster91 4y ago

Sweet jesus that's easy. Wonder if stuff like Samsung ODIN (which already has a OSS clone) could be ported to that.

selfhoster11 4y ago
Web MiniDisc folks ported the reverse-engineered the NetMD protocol tools to JS, and can now upload audio and patch device firmware on any MD device connected via Chrome/Chromium. Porting Odin is likely to be feasible.
rany_ 4y ago
Has been done with https://github.com/kdrag0n/fastboot.js https://github.com/kdrag0n/fastboot.js, might be feasible with Odin as well..
kevingadd 4y ago
I believe the device also needs to be WebUSB compatible, unless that part of the design changed - it's a measure to reduce the attack surface by not letting webpages talk to old pre-WebUSB hardware that might have vulnerabilities.
- TobTobXX 4y ago
  If I'be read it correctly it _can_ announce itself over WebUSB. And I suppose this announcement contains a landing URL, which Chrome will then show upon plug-in of the device. So device-side WebUSB capability seems like a feature, rather than a requirement for browser-side communication.
  - selfhoster11 4y ago
    It’s certainly not a requirement for the device to support WebUSB. NetMD recorders were created long before WebUSB, but can still be used from a browser app.
jeroenhd 4y ago
Definitely possible, especially with native-to-WASM tooling. I've used a web page to run ADB commands to quickly debloat my phone, so I don't see why fastboot support wouldn't work. There's even a tool to flash your Android phone through the browser (https://pixelrepair.withgoogle.com/ https://pixelrepair.withgoogle.com/ I believe). Adding "automated LineageOS installer through WebUSB" to my infinitely growing to-do list :)
- intelVISA 4y ago
  That sounds great, I hope you pursue it. Do you know of any specific risks when flashing devices w/ WebUSB as opposed to the 'normal' way?
  - mschuster91 4y ago
    With Google's devices I think and hope that the code accounts both on the web side and the device firmware side for interrupted communications or latency due to whatever external factors (e.g. another page that is running in the same execution context sending the single JS thread into a loop or lock). With non-Google devices... these might run into problems when the device expects a certain response latency or minimum bandwidth. YMMV I'd say.