3 ms·

Webusb/hid are scary powerful but for some reason I've never heard of malware attempting to use it. It's a neat party trick for being able to program usb enable

by eyegor 2y ago

Webusb/hid are scary powerful but for some reason I've never heard of malware attempting to use it. It's a neat party trick for being able to program usb enabled chips from a browser but I could never figure out another use case.

archerx 2y ago
I used it to make an NFC login system for a web interface. I would like to explore webUSB more.
idle_zealot 2y ago
The requirement for the browser to explicitly ask the user to give the site access to a specific connected USB/BT device makes this a tricky vector. You would need to pose as a webapp with a legitimate need to access the device you're targeting.
- Thorrez 2y ago
  Previously that attack was possible against USB security keys (U2F/FIDO). Browsers fixed it though by blocking webusb from interacting with security keys. https://www.yubico.com/support/security-advisories/ysa-2018-02/ https://www.yubico.com/support/security-advisories/ysa-2018-...
  - drdaeman 2y ago
    Which sucks, because I hoped there would be a way to use HSMs in browser for {en,de}cryption. A lot of those devices aren't just for FIDO, they have PKCS#11 and OpenPGP. WebAuthn/U2F is not designed for this. As it usually happens in tech, people hack weird contraptions afterwards (largeBlob, prf and hmac-secret) allowing to at least attach or derive the symmetric keys, but this isn't a solution even if it would've worked.
- graemep 2y ago
  A lot of people will click OK to anything though.
  - idle_zealot 2y ago
    The best we can do is make it hard to own yourself by accident. The alternative is to give up on user control. Some users will ignore all warnings and install malware, get phished, and send money to Nigerian princes. We can try to educate them and make things as clear as possible, but removing or limiting functionality because some portion or users will misuse it is a bad idea.
  - bastawhiz 2y ago
    The same people who will click allow on anything will also happily download and run a random APK or executable
  - beeboobaa3 2y ago
    That's their choice. Sick and tired of developers dumbing everything down to protect this special breed of idiot.
BrutalCoding 2y ago
A use case I’d like to see is having VSCode (e.g. code-server) or any other web IDE for that matter, and being able to attach a debugger process that’s connected to my usb device (e.g. Android phone) for app development. I can setup a (macOS) VM and expose the web IDE securely to myself, but I wasn’t able to find a working solution about a year ago. The closest solution for me right now is using Google’s IDE ‘IDX’, basically a web VSCode with a right side panel containing an actual Android/iOS emulator. It’s neat, but I’d rather use my physical devices over USB during development. PS. If anyone knows how to set this up, please share!

by eyegor 2y ago

archerx 2y ago

I used it to make an NFC login system for a web interface. I would like to explore webUSB more.

idle_zealot 2y ago

The requirement for the browser to explicitly ask the user to give the site access to a specific connected USB/BT device makes this a tricky vector. You would need to pose as a webapp with a legitimate need to access the device you're targeting.

Thorrez 2y ago
Previously that attack was possible against USB security keys (U2F/FIDO). Browsers fixed it though by blocking webusb from interacting with security keys. https://www.yubico.com/support/security-advisories/ysa-2018-02/ https://www.yubico.com/support/security-advisories/ysa-2018-...
- drdaeman 2y ago
  Which sucks, because I hoped there would be a way to use HSMs in browser for {en,de}cryption. A lot of those devices aren't just for FIDO, they have PKCS#11 and OpenPGP. WebAuthn/U2F is not designed for this. As it usually happens in tech, people hack weird contraptions afterwards (largeBlob, prf and hmac-secret) allowing to at least attach or derive the symmetric keys, but this isn't a solution even if it would've worked.
graemep 2y ago
A lot of people will click OK to anything though.
- idle_zealot 2y ago
  The best we can do is make it hard to own yourself by accident. The alternative is to give up on user control. Some users will ignore all warnings and install malware, get phished, and send money to Nigerian princes. We can try to educate them and make things as clear as possible, but removing or limiting functionality because some portion or users will misuse it is a bad idea.
- bastawhiz 2y ago
  The same people who will click allow on anything will also happily download and run a random APK or executable
- beeboobaa3 2y ago
  That's their choice. Sick and tired of developers dumbing everything down to protect this special breed of idiot.

BrutalCoding 2y ago

A use case I’d like to see is having VSCode (e.g. code-server) or any other web IDE for that matter, and being able to attach a debugger process that’s connected to my usb device (e.g. Android phone) for app development. I can setup a (macOS) VM and expose the web IDE securely to myself, but I wasn’t able to find a working solution about a year ago. The closest solution for me right now is using Google’s IDE ‘IDX’, basically a web VSCode with a right side panel containing an actual Android/iOS emulator. It’s neat, but I’d rather use my physical devices over USB during development. PS. If anyone knows how to set this up, please share!