3 ms·
> It is available only for Google Chrome, Chromium or compatiable browsers (e.g. Edge) because it uses WebHID, a javascript extension that can be used to send c
by sotix 3y ago
> It is available only for Google Chrome, Chromium or compatiable browsers (e.g. Edge) because it uses WebHID, a javascript extension that can be used to send commands to a HID device.
I didn’t know about WebHID, but it’s interesting Firefox doesn’t support it. According to Mozilla’s position[0]:
> This API, like WebUSB, provides access to generic devices. Though this API is limited to human interface devices (HID), the same concerns apply as WebUSB, namely that devices are generally not designed with access from arbitrary websites in their threat model.
[0]: https://mozilla.github.io/standards-positions/#webhid https://mozilla.github.io/standards-positions/#webhid
- deleted 3y ago[deleted]
- colordrops 3y agoWhat is the chrome team's threat model for this? Why are they ok with it?
- TylerE 3y agoProbably because it's listening to two general purpose input devices all the time at the very least? If you're that paranoid you probably shouldn't be using a non air-gapped machine in the first place.
- 0cf8612b2e1e 3y agoChrome enables Chrome OS. These security holes are allowed into the spec to ensure the Chrome machines are not totally hobbled.
- modeless 3y agoThey are OK with it because it's behind an explicit permission dialog and the user has to specifically choose a single device to grant access. I doubt there's been a single instance of a real world attack using this API. It's been enabled by default in Chrome for years, so it's not like there hasn't been an opportunity. This is just concern trolling by people who dislike the modern web for other reasons.
- 0cf8612b2e1e 3y agoWell, it did break the security of YubiKeys https://www.pcmag.com/news/google-chrome-feature-pokes-security-hole-in-yubikey-product https://www.pcmag.com/news/google-chrome-feature-pokes-secur...
- modeless 3y agoThat's research, never used in a real world attack. It's long since patched, and also that's not the WebHID API.
- 0cf8612b2e1e 3y agoMoving goal posts. I guess all of this xz stuff is overblown because we do not have a documented case where it was used? Just research about something that might happen does not count, I guess. Here is a WebHID attack in Chrome with a 9.8 severity (https://www.cve.news/cve-2023-1529/ https://www.cve.news/cve-2023-1529/)
- modeless 3y agoI moved nothing. You didn't read my original comment that clearly specified "real world attack". Your second link doesn't qualify either. Besides, if you can connect a malicious USB device to the user's computer you've already won. There are a million ways to exploit that which have nothing to do with Chrome. The xz thing was a big deal precisely because it was a real world attack. It wasn't something created by researchers as a proof of concept and disclosed to vendors. It was discovered in the wild, luckily before it caused any damage, but it was absolutely a real world attack.
- hnburnsy 3y agoOr WebKit, per Apple... >Here are some examples of features we have decided to not yet implement due to fingerprinting, security, and other concerns, and where we do not yet see a path to resolving those concerns: Web Bluetooth Web MIDI API Magnetometer API Web NFC API Device Memory API Network Information API Battery Status API Web Bluetooth Scanning Ambient Light Sensor HDCP Policy Check extension for EME Proximity Sensor WebHID Serial API Web USB Geolocation Sensor (background geolocation) User Idle Detection