3 ms·
> I think they're right to be wary, but then again, Chrome shipped this in 2021. Just because Chrome shipped something: - doesn't make it a standard - doesn'
by troupo 3y ago
> I think they're right to be wary, but then again, Chrome shipped this in 2021.
Just because Chrome shipped something:
- doesn't make it a standard
- doesn't make it secure
Can't say for WebSerial, but when Mozilla shipped WebMIDI they immediately discovered that it was used for fingerprinting (https://twitter.com/denschub/status/1582730985778556931 https://twitter.com/denschub/status/1582730985778556931), and Chrome was silently letting sites enumerate MIDI devices on a user's computer (https://twitter.com/denschub/status/1582730988118867968 https://twitter.com/denschub/status/1582730988118867968)
- skybrian 3y agoNo, of course not, but I think we should be curious about it. For example, what have security researchers discovered about WebSerial as implemented in Chrome?
- troupo 3y agoYou don't even have to discover anything. The spec itself lists unmitigated issues that are the same for other hardware APIs too: https://wicg.github.io/serial/#security https://wicg.github.io/serial/#security