4 ms·

What is the chrome team's threat model for this? Why are they ok with it?

TylerE 3y ago
Probably because it's listening to two general purpose input devices all the time at the very least? If you're that paranoid you probably shouldn't be using a non air-gapped machine in the first place.
0cf8612b2e1e 3y ago
Chrome enables Chrome OS. These security holes are allowed into the spec to ensure the Chrome machines are not totally hobbled.
modeless 3y ago
They are OK with it because it's behind an explicit permission dialog and the user has to specifically choose a single device to grant access. I doubt there's been a single instance of a real world attack using this API. It's been enabled by default in Chrome for years, so it's not like there hasn't been an opportunity. This is just concern trolling by people who dislike the modern web for other reasons.
- 0cf8612b2e1e 3y ago
  Well, it did break the security of YubiKeys https://www.pcmag.com/news/google-chrome-feature-pokes-security-hole-in-yubikey-product https://www.pcmag.com/news/google-chrome-feature-pokes-secur...
  - modeless 3y ago
    That's research, never used in a real world attack. It's long since patched, and also that's not the WebHID API.
    - 0cf8612b2e1e 3y ago
      Moving goal posts. I guess all of this xz stuff is overblown because we do not have a documented case where it was used? Just research about something that might happen does not count, I guess. Here is a WebHID attack in Chrome with a 9.8 severity (https://www.cve.news/cve-2023-1529/ https://www.cve.news/cve-2023-1529/)
      - modeless 3y ago
        I moved nothing. You didn't read my original comment that clearly specified "real world attack". Your second link doesn't qualify either. Besides, if you can connect a malicious USB device to the user's computer you've already won. There are a million ways to exploit that which have nothing to do with Chrome. The xz thing was a big deal precisely because it was a real world attack. It wasn't something created by researchers as a proof of concept and disclosed to vendors. It was discovered in the wild, luckily before it caused any damage, but it was absolutely a real world attack.

Probably because it's listening to two general purpose input devices all the time at the very least? If you're that paranoid you probably shouldn't be using a non air-gapped machine in the first place.

0cf8612b2e1e 3y ago

Chrome enables Chrome OS. These security holes are allowed into the spec to ensure the Chrome machines are not totally hobbled.

modeless 3y ago

They are OK with it because it's behind an explicit permission dialog and the user has to specifically choose a single device to grant access. I doubt there's been a single instance of a real world attack using this API. It's been enabled by default in Chrome for years, so it's not like there hasn't been an opportunity. This is just concern trolling by people who dislike the modern web for other reasons.

0cf8612b2e1e 3y ago
Well, it did break the security of YubiKeys https://www.pcmag.com/news/google-chrome-feature-pokes-security-hole-in-yubikey-product https://www.pcmag.com/news/google-chrome-feature-pokes-secur...
- modeless 3y ago
  That's research, never used in a real world attack. It's long since patched, and also that's not the WebHID API.
  - 0cf8612b2e1e 3y ago
    Moving goal posts. I guess all of this xz stuff is overblown because we do not have a documented case where it was used? Just research about something that might happen does not count, I guess. Here is a WebHID attack in Chrome with a 9.8 severity (https://www.cve.news/cve-2023-1529/ https://www.cve.news/cve-2023-1529/)
    - modeless 3y ago
      I moved nothing. You didn't read my original comment that clearly specified "real world attack". Your second link doesn't qualify either. Besides, if you can connect a malicious USB device to the user's computer you've already won. There are a million ways to exploit that which have nothing to do with Chrome. The xz thing was a big deal precisely because it was a real world attack. It wasn't something created by researchers as a proof of concept and disclosed to vendors. It was discovered in the wild, luckily before it caused any damage, but it was absolutely a real world attack.