9 ms·

This is cool, but both safari and firefox will not implement it: https://usefulangle.com/web-updates/post/80/firefox-decines-to-implement-web-usb-api https://u

This is cool, but both safari and firefox will not implement it: https://usefulangle.com/web-updates/post/80/firefox-decines-to-implement-web-usb-api https://usefulangle.com/web-updates/post/80/firefox-decines-... I assume this is because of security concerns.

moondev 4y ago
Security or privacy (thumbprinting)? To be fair I'm still exploring it, once you choose a USB device when prompted, is that access for the session or longer?
- ocdtrekkie 4y ago
  I think it might be session, but the issue is that most users simply accept permission popups, often without consciously recognizing they did. I've cleaned out the notifications permissions on browsers for dozens of people; all of them denied allowing various websites to spam them with notifications.
protonscientist 4y ago
Am I alone in thinking even its Chrome implementation is a massive security risk? The fact that users can grant any webpage COMPLETE control of a USB attached device is astonishing. Live webpages shouldn't be able to access this feature - can't wait for fake jailbreak and backup services to start cropping up.
- ocdtrekkie 4y ago
  It's an incredibly bad idea, at work for the one Chromium browser we permit (Edge), we have to use policies to block this and several dozen major security vulnerabilities that exist solely because they make cool Google I/O demos.
  - taviso 4y ago
    Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites. The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse. The situation today is you buy a random USB gadget (e.g. a fitness tracker), but you can't use it without also installing the accompanying software/drivers. That effectively gives the manufacturer complete control of your computer. All you really wanted was for them to sync your step count, but you have no option but to give them complete remote access to your computer. With Web USB you can allow vendor.com to access device 1234:5678 only, and revoke that access whenever you like. Sure, maybe you could be tricked into clicking through all the confirmations and granting https://fakevendor.com https://fakevendor.com access to a device. That could be bad - but no worse (and probably a lot better) than being tricked into downloading and running fakedriver.exe. (disclaimer: I work for Google, have nothing to do with Chrome)
    - ocdtrekkie 4y ago
      I explain in a neighboring comment: https://news.ycombinator.com/item?id=34563795 https://news.ycombinator.com/item?id=34563795 It's crucially important that Googlers are divorced of the belief a permission popup on the top of the screen is adequate indication of intent/informed consent. People approve these all the time without understanding what it's for. Installing software is, at minimum, a very distinct action which users are aware of doing. Generally, they install a limited number of applications for specific purposes, whereas they may visit literally thousands of websites a month. Pretending these two things can be interchangeable is silly. I am not entirely opposed to being able to use a browser as the UI for an activity like this, but it should require a higher bar to activate it for a specific server to talk to a specific device. Even web extension installs remain far too easy to not be maliciously abused widely. (Chrome extensions remain the primary malware I see in the wild.) EDIT: The HN gods have me rate limited so hopefully you'll see my response here to the below comment: Installing software is a complex process. It entails navigating to the correct site, locating a download, fishing it out of the downloads bar (many seniors cannot find this, by the way, it absolutely baffles them), opening it, usually acknowledging that you know it's an executable program, and then navigating the install wizard. A software engineer would reasonably believe simplifying this is a good thing, but as noted, people regularly accept malware into their browser and do not even consciously realize they did it because it involves a single click. People absolutely get misled into installing bad software, but they always know they actually did it, it's impossible to follow that chain without having some idea you're doing something. Accepting malware isn't the answer, understanding people is. There is no technical solution for security, because it's a human problem.
- CamperBob2 4y ago
  So because a few bad actors might abuse it, and some users will fall into the traps laid for them, none of us get to use it. I reject this way of thinking. Letting bad guys dictate how you live your life and how you use your computer just doesn't scale that well.
  - bobkazamakis 4y ago
    systems that allow such brazen exploitation cease to exist, so who cares about scalability?
    - CamperBob2 4y ago
      Do they cease to exist because of gatekeepers, criminals, or both?
8K832d7tNmiQ 4y ago
It should be an opt-in feature behind browser flag or only available for enterprise users IMO.
spookthesunset 4y ago
That article is from 2020…
- dmitriid 4y ago
  Nothing has changed. Both Safari and Firefox are against most hardware APIs for reasons of security and privacy. Sometimes they implement a seemingly innocuous API like WebMIDI, and boom, fingerprinting: https://twitter.com/denschub/status/1582730985778556931?s=20&t=p1OSXAaVuTro08wBDNmFjQ https://twitter.com/denschub/status/1582730985778556931?s=20...

moondev 4y ago

Security or privacy (thumbprinting)? To be fair I'm still exploring it, once you choose a USB device when prompted, is that access for the session or longer?

ocdtrekkie 4y ago
I think it might be session, but the issue is that most users simply accept permission popups, often without consciously recognizing they did. I've cleaned out the notifications permissions on browsers for dozens of people; all of them denied allowing various websites to spam them with notifications.

protonscientist 4y ago

Am I alone in thinking even its Chrome implementation is a massive security risk? The fact that users can grant any webpage COMPLETE control of a USB attached device is astonishing. Live webpages shouldn't be able to access this feature - can't wait for fake jailbreak and backup services to start cropping up.

ocdtrekkie 4y ago
It's an incredibly bad idea, at work for the one Chromium browser we permit (Edge), we have to use policies to block this and several dozen major security vulnerabilities that exist solely because they make cool Google I/O demos.
- taviso 4y ago
  Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites. The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse. The situation today is you buy a random USB gadget (e.g. a fitness tracker), but you can't use it without also installing the accompanying software/drivers. That effectively gives the manufacturer complete control of your computer. All you really wanted was for them to sync your step count, but you have no option but to give them complete remote access to your computer. With Web USB you can allow vendor.com to access device 1234:5678 only, and revoke that access whenever you like. Sure, maybe you could be tricked into clicking through all the confirmations and granting https://fakevendor.com https://fakevendor.com access to a device. That could be bad - but no worse (and probably a lot better) than being tricked into downloading and running fakedriver.exe. (disclaimer: I work for Google, have nothing to do with Chrome)
  - ocdtrekkie 4y ago
    I explain in a neighboring comment: https://news.ycombinator.com/item?id=34563795 https://news.ycombinator.com/item?id=34563795 It's crucially important that Googlers are divorced of the belief a permission popup on the top of the screen is adequate indication of intent/informed consent. People approve these all the time without understanding what it's for. Installing software is, at minimum, a very distinct action which users are aware of doing. Generally, they install a limited number of applications for specific purposes, whereas they may visit literally thousands of websites a month. Pretending these two things can be interchangeable is silly. I am not entirely opposed to being able to use a browser as the UI for an activity like this, but it should require a higher bar to activate it for a specific server to talk to a specific device. Even web extension installs remain far too easy to not be maliciously abused widely. (Chrome extensions remain the primary malware I see in the wild.) EDIT: The HN gods have me rate limited so hopefully you'll see my response here to the below comment: Installing software is a complex process. It entails navigating to the correct site, locating a download, fishing it out of the downloads bar (many seniors cannot find this, by the way, it absolutely baffles them), opening it, usually acknowledging that you know it's an executable program, and then navigating the install wizard. A software engineer would reasonably believe simplifying this is a good thing, but as noted, people regularly accept malware into their browser and do not even consciously realize they did it because it involves a single click. People absolutely get misled into installing bad software, but they always know they actually did it, it's impossible to follow that chain without having some idea you're doing something. Accepting malware isn't the answer, understanding people is. There is no technical solution for security, because it's a human problem.
CamperBob2 4y ago
So because a few bad actors might abuse it, and some users will fall into the traps laid for them, none of us get to use it. I reject this way of thinking. Letting bad guys dictate how you live your life and how you use your computer just doesn't scale that well.
- bobkazamakis 4y ago
  systems that allow such brazen exploitation cease to exist, so who cares about scalability?
  - CamperBob2 4y ago
    Do they cease to exist because of gatekeepers, criminals, or both?

8K832d7tNmiQ 4y ago

It should be an opt-in feature behind browser flag or only available for enterprise users IMO.

spookthesunset 4y ago

That article is from 2020…

dmitriid 4y ago
Nothing has changed. Both Safari and Firefox are against most hardware APIs for reasons of security and privacy. Sometimes they implement a seemingly innocuous API like WebMIDI, and boom, fingerprinting: https://twitter.com/denschub/status/1582730985778556931?s=20&t=p1OSXAaVuTro08wBDNmFjQ https://twitter.com/denschub/status/1582730985778556931?s=20...