4 ms·

Wait until these guys hear about WebUSB, WebSerialPort, WebBootloader, WebFirmware, and WebHardDiskPartitioner! I hear they are working on even more APIs for T

Wait until these guys hear about WebUSB, WebSerialPort, WebBootloader, WebFirmware, and WebHardDiskPartitioner! I hear they are working on even more APIs for TheWeb(tm).

eyegor 3y ago
Webusb/hid are scary powerful but for some reason I've never heard of malware attempting to use it. It's a neat party trick for being able to program usb enabled chips from a browser but I could never figure out another use case.
- archerx 3y ago
  I used it to make an NFC login system for a web interface. I would like to explore webUSB more.
- idle_zealot 3y ago
  The requirement for the browser to explicitly ask the user to give the site access to a specific connected USB/BT device makes this a tricky vector. You would need to pose as a webapp with a legitimate need to access the device you're targeting.
  - Thorrez 3y ago
    Previously that attack was possible against USB security keys (U2F/FIDO). Browsers fixed it though by blocking webusb from interacting with security keys. https://www.yubico.com/support/security-advisories/ysa-2018-02/ https://www.yubico.com/support/security-advisories/ysa-2018-...
    - drdaeman 3y ago
      Which sucks, because I hoped there would be a way to use HSMs in browser for {en,de}cryption. A lot of those devices aren't just for FIDO, they have PKCS#11 and OpenPGP. WebAuthn/U2F is not designed for this. As it usually happens in tech, people hack weird contraptions afterwards (largeBlob, prf and hmac-secret) allowing to at least attach or derive the symmetric keys, but this isn't a solution even if it would've worked.
  - graemep 3y ago
    A lot of people will click OK to anything though.
    - idle_zealot 3y ago
      The best we can do is make it hard to own yourself by accident. The alternative is to give up on user control. Some users will ignore all warnings and install malware, get phished, and send money to Nigerian princes. We can try to educate them and make things as clear as possible, but removing or limiting functionality because some portion or users will misuse it is a bad idea.
    - bastawhiz 3y ago
      The same people who will click allow on anything will also happily download and run a random APK or executable
    - beeboobaa3 3y ago
      That's their choice. Sick and tired of developers dumbing everything down to protect this special breed of idiot.
- BrutalCoding 3y ago
  A use case I’d like to see is having VSCode (e.g. code-server) or any other web IDE for that matter, and being able to attach a debugger process that’s connected to my usb device (e.g. Android phone) for app development. I can setup a (macOS) VM and expose the web IDE securely to myself, but I wasn’t able to find a working solution about a year ago. The closest solution for me right now is using Google’s IDE ‘IDX’, basically a web VSCode with a right side panel containing an actual Android/iOS emulator. It’s neat, but I’d rather use my physical devices over USB during development. PS. If anyone knows how to set this up, please share!
AshamedCaptain 3y ago
Don't forget WebBluetooth! Already shipping in chrome and literally used to do OTA firmware upgrades of InternetOfThings(TM) devices. What could possibly go wrong ?
- altairprime 3y ago
  What’s the difference between firmware updates using OWA and firmware updates using APK? A native Android app isn’t more secure than a web page running on that device, and the champions of Open Web Apps need the same hardware access privileges as native apps have in order to be a viable competing platform for development. HN is very strongly in favor of OWAs, so it’s confusing to see hostility to hardware access by webpages here? How else could a firmware updater app work?
dormento 3y ago
> WebHardDiskPartitioner Made me look.
- scintill76 3y ago
  Therapist: WebHardDiskPartitioner isn't real, it can't hurt you. Chrome engineer: Hold my beer!
deleted 3y ago
[deleted]
signal11 3y ago
WebVibrator is a thing. No, really*: https://developer.mozilla.org/en-US/docs/Web/API/Vibration_API https://developer.mozilla.org/en-US/docs/Web/API/Vibration_A... *Not supported on Safari, thank goodness!
OneLeggedCat 3y ago
> WebHardDiskPartitioner I lol'd at that one. No one would never make such a thing... Wait would they?!?!
- Jensson 3y ago
  If you want to replace OS programs with browser apps you need it, and some thinks that you should be able to do everything in the browser.
- OneLeggedCat 3y ago
  WebDBAN. WebRootFolderRemover. WebHardDriveMusic.
  - nmeagent 3y ago
    > WebHardDriveMusic I can hear it now: millions of non-solid-state drives across the Internet playing the Imperial March in sync...

Wait until these guys hear about WebUSB, WebSerialPort, WebBootloader, WebFirmware, and WebHardDiskPartitioner! I hear they are working on even more APIs for TheWeb(tm).

eyegor 3y ago

Webusb/hid are scary powerful but for some reason I've never heard of malware attempting to use it. It's a neat party trick for being able to program usb enabled chips from a browser but I could never figure out another use case.

archerx 3y ago
I used it to make an NFC login system for a web interface. I would like to explore webUSB more.
idle_zealot 3y ago
The requirement for the browser to explicitly ask the user to give the site access to a specific connected USB/BT device makes this a tricky vector. You would need to pose as a webapp with a legitimate need to access the device you're targeting.
- Thorrez 3y ago
  Previously that attack was possible against USB security keys (U2F/FIDO). Browsers fixed it though by blocking webusb from interacting with security keys. https://www.yubico.com/support/security-advisories/ysa-2018-02/ https://www.yubico.com/support/security-advisories/ysa-2018-...
  - drdaeman 3y ago
    Which sucks, because I hoped there would be a way to use HSMs in browser for {en,de}cryption. A lot of those devices aren't just for FIDO, they have PKCS#11 and OpenPGP. WebAuthn/U2F is not designed for this. As it usually happens in tech, people hack weird contraptions afterwards (largeBlob, prf and hmac-secret) allowing to at least attach or derive the symmetric keys, but this isn't a solution even if it would've worked.
- graemep 3y ago
  A lot of people will click OK to anything though.
  - idle_zealot 3y ago
    The best we can do is make it hard to own yourself by accident. The alternative is to give up on user control. Some users will ignore all warnings and install malware, get phished, and send money to Nigerian princes. We can try to educate them and make things as clear as possible, but removing or limiting functionality because some portion or users will misuse it is a bad idea.
  - bastawhiz 3y ago
    The same people who will click allow on anything will also happily download and run a random APK or executable
  - beeboobaa3 3y ago
    That's their choice. Sick and tired of developers dumbing everything down to protect this special breed of idiot.
BrutalCoding 3y ago
A use case I’d like to see is having VSCode (e.g. code-server) or any other web IDE for that matter, and being able to attach a debugger process that’s connected to my usb device (e.g. Android phone) for app development. I can setup a (macOS) VM and expose the web IDE securely to myself, but I wasn’t able to find a working solution about a year ago. The closest solution for me right now is using Google’s IDE ‘IDX’, basically a web VSCode with a right side panel containing an actual Android/iOS emulator. It’s neat, but I’d rather use my physical devices over USB during development. PS. If anyone knows how to set this up, please share!

AshamedCaptain 3y ago

Don't forget WebBluetooth! Already shipping in chrome and literally used to do OTA firmware upgrades of InternetOfThings(TM) devices. What could possibly go wrong ?

altairprime 3y ago
What’s the difference between firmware updates using OWA and firmware updates using APK? A native Android app isn’t more secure than a web page running on that device, and the champions of Open Web Apps need the same hardware access privileges as native apps have in order to be a viable competing platform for development. HN is very strongly in favor of OWAs, so it’s confusing to see hostility to hardware access by webpages here? How else could a firmware updater app work?

dormento 3y ago

> WebHardDiskPartitioner Made me look.

scintill76 3y ago
Therapist: WebHardDiskPartitioner isn't real, it can't hurt you. Chrome engineer: Hold my beer!

deleted 3y ago

[deleted]

signal11 3y ago

WebVibrator is a thing. No, really*: https://developer.mozilla.org/en-US/docs/Web/API/Vibration_API https://developer.mozilla.org/en-US/docs/Web/API/Vibration_A... *Not supported on Safari, thank goodness!

OneLeggedCat 3y ago

> WebHardDiskPartitioner I lol'd at that one. No one would never make such a thing... Wait would they?!?!

Jensson 3y ago
If you want to replace OS programs with browser apps you need it, and some thinks that you should be able to do everything in the browser.
OneLeggedCat 3y ago
WebDBAN. WebRootFolderRemover. WebHardDriveMusic.
- nmeagent 3y ago
  > WebHardDriveMusic I can hear it now: millions of non-solid-state drives across the Internet playing the Imperial March in sync...