9 ms·
I-cant-believe-its-not-webusb: Hacking around lack of WebUSB support in Firefox
- mevv 2y agopretty sweet
- agluszak 2y ago> WebUSB and its associated political disagreements What are the political disagreements?
- nicman23 2y agoprobably that your browser can access the hardware. which i also do not want.
- tux3 2y agoThe politics of exposing users to security issues VS giving the web more capabilities. A fight which is usually won by people who just want features now. Security flaws tend to look hypothetical until people actually exploit them in the wild.
- usrnm 2y agoIf history teaches us anything, it's the fact that we will come full circle, the browser will become the os at some point. People with money want it to happen and they have resources to make us think that we want it too. Might as well enjoy the ride
- gostsamo 2y agoshould a browser have api-s allowing websites to access directly the file system and usb devices which might be insecure and help in fingerprinting or it should not. a.k.a chrome against all the ants.
- jeroenhd 2y agoIn this case, Safari also doesn't implement the API, and that's far from an ant. Plenty of cases where something is effectively everywhere but in Firefox, but this time Apple also decided against it.
- gostsamo 2y agoSafari is an ant standing on the shoulders of a giant apple.
- pests 2y agoIt already does though. It's the type=upload box we've had for decades. Think of it as how smartphones let you give access to only a specific file or see a subset of files. The "UI" is just using a system control. You can also drag and drop files into the browser too. This is all available to javascript.
- Kbelicius 2y ago> It already does though. It doesn't. Websites don't have access to your file system. > It's the type=upload box we've had for decades. It isn't. That isn't giving the access to your file system to a website. That is simply providing a file to a website. The website doesn't even get the real path to the file but a C:\fakepath\filename. > You can also drag and drop files into the browser too. This is all available to javascript. Again, that is not giving access to your filesystem to a website. That is giving a file to a website.
- pests 2y agoI do agree partially but I don't see a difference in practice Using your definition every app on Android and Apple doesn't have access to your filesystem either. Just like you have to select which image from your camera roll that Facebook is allowed to see / access. It gets that one image, and only that image, on purpose. It doesn't get to have a free for all through your files.
- tannhaeuser 2y agoFingerprinting, basically, and whether browsers should gain any more capabilities at this point which just deepens the dependency on Chrome further and further.
- nicce 2y agoAbout fingerprinting - was the WebUSB made poorly? I believe the device information can be strictly restricted and given only on user consent. E.g. by default browser sees only plugged-in status of certain device categories.
- vbezhenar 2y agoYou don't see anything without user consent.
- nicce 2y agoIt works like that or you think it should work like that? If browser gets zero information, it drastically reduces UX. It even does not know to suggest permission popups without being misleading in the end.
- vbezhenar 2y agoI don't think, I wrote enough code with those APIs. You call `navigator.usb.requestDevice({filters})`. It returns a promise and browser displays a window with device list according to the given filter. User chooses device or presses "cancel". The promise resolves with single device or rejects with error. You can't fingerprint anything without user interaction. Also there's block list which does not allow to connect to keyboard, mouse, so typical user does not even have any USB devices to choose from.
- deleted 2y ago[deleted]
- swiftcoder 2y agoWhile fingerprinting is a concern with many web extensions, the bigger problem here is the security risks inherent in exposing on the open internet a bunch of USB devices that were not designed with adversarial inputs in mind...
- JimDabell 2y agoWebUSB is not a web standard. It’s a Blink-only API cooked up by Google and rejected by both Mozilla and Apple on privacy and security grounds. It cannot become a web standard without two independent implementations, and Google have failed to convince anybody outside of Google to implement it. Nevertheless, it pops up on various websites as things Firefox and Safari are “failing” to support. > This specification was published by the Web Platform Incubator Community Group. It is not a W3C Standard nor is it on the W3C Standards Track. — https://wicg.github.io/webusb/ https://wicg.github.io/webusb/ > WebKit declined to implement several APIs, including WebUSB, due to concerns over fingerprinting > We have previously stated privacy concerns, thus the concerns: privacy label. We agree with Mozilla's security concerns raised in their standards position issue, thus the concerns: security label. — https://github.com/WebKit/standards-positions/issues/68 https://github.com/WebKit/standards-positions/issues/68 > Because many USB devices are not designed to handle potentially-malicious interactions over the USB protocols and because those devices can have significant effects on the computer they're connected to, we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent. It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers. — https://mozilla.github.io/standards-positions/#webusb https://mozilla.github.io/standards-positions/#webusb
- mvdtnz 2y ago[flagged]
- Orygin 2y agoYou are not losing functionality if it was never implemented in the first place. WebUSB and WebSerial are not standards, so your rage is misdirected. Keep using your security cheese of a browser if you need that feature. Otherwise others (like myself) are okay with having fewer security risks in their browsers.
- deleted 2y ago[deleted]
- jlarocco 2y agoI don't know the general political disagreements, but I personally don't want WebUSB and think it's a garbage idea. The browser can already access the USB devices it needs through normal OS interfaces (the keyboard and mouse being the obvious examples). I don't see why any website should need special direct access. The only use-cases seem to be giving access to web programmers who can't be bothered to write a standalone application (not a group I trust) or to provide additional ways to track users (something I don't want). I don't even trust Google and Mozilla enough to give them access, much less any random stranger who's setup a website. Not everything needs to be accessible from the web. I don't know where the line is, but for me USB access is across the line.
- bsder 2y ago> I don't see why any website should need special direct access. And this also holds back things like better security from USB security keys. You have to access the key in exactly the way that is implemented ... even if that implementation sucks or has bugs or has security failures. Everybody hates Electron .. but then want to hamstring the browsers. Well, people still want do do the thing they want even if you don't let them. They will find a way around .. and currently that way around is Electron.
- consteval 2y agoI believe USB security keys are covered under a different API. But even then, you can use this argument against it. When this type of USB access is allowed, it gives phishing attacks even more power. Now, you’ll click prompts for authentication and little did you know that malicious actors and read/write the entire USB drive!
- tetris11 2y agoIf you have a keyboard with QMK/Via firmware, customising it with WebUSB is a nightmare. You essentially have to make one of your /dev/hidraw devices completely world readable (inviting all sorts of keylogging shenanigans) before the browser can interact with the firmware. Its creepy beyond creepy in terms of usage, and offline customization tools are all Electron based so there's not much advantage. One reasonable workaround is to construct your desired keyboard layout with a template json file on the website, download the resulting json and then flash the firmware to your keyboard via sudo-level flashing tool. Still, I wish there was a less creepy way.
- mschuster91 2y ago> Still, I wish there was a less creepy way. There should be - there's three LEDs (capslock, numlock and I forget the third one) on standard keyboards which can all be set from the OS side... and at least caps lock (I think!) can be set from Javascript, so it's essentially an 1 bit wide communications bus, three bits if it's an ordinary OS tool.
- unwind 2y agoI think the third is scroll lock [1]. That one feels quite legacy to me, every time I active it it's by accident and I don't understand why stuff is behaving weirdly. [1]: https://en.wikipedia.org/wiki/Scroll_Lock https://en.wikipedia.org/wiki/Scroll_Lock
- jeroenhd 2y agoI love scroll lock still existing on keyboards. Some operating systems still use it to control text scroll for some reason (useful when you don't have `screen` installed maybe?), but I mostly use it for toggles in video games. It shows the toggle state on a physical interface, like one of those fancy programmable macro keyboards, but on commodity hardware!
- Tijdreiziger 2y agoI believe there are still a number of applications where Scroll Lock is useful, most notably Microsoft Excel.
- MortyWaves 2y agoMaybe it’s a good thing USB ports are not available to browser based code.
- saint_yossarian 2y agoAs a Linux user I love WebMIDI, because it means I don't have to open a Windows VM anymore to run firmware updates / utility tools for audio gear manufacturers that embrace it (e.g. Novation). WebUSB should enable the same for more types of devices, but of course there should be appropriate permission mechanisms.
- rasjani 2y agoWebmidi is godsent for Akai LPD8 controllers. It came with software that's used to reprogramming midi banks. Software never got updates and doesnt work anymore in any modern mac. Thank $deity for webmidi and some reverse engineering, i can reprogram it to a degree that its at least functional and dont need to throw it away.
- MortyWaves 2y agoWhy does that require a browser and not software you run natively?
- JimDabell 2y agoWebMIDI has been used by porn sites to track users: https://news.ycombinator.com/item?id=23679063 https://news.ycombinator.com/item?id=23679063
- _flux 2y agoAs I understand it, it was because WebMIDI was accepted by Chrome without prompting the user. To me it seems should be impossible use it for tracking after they added the prompt.
- cship2 2y agoWhenever the committe crams another desktop features into the browser you can be sure it is mainly convenience and surveillance!
- dz0ny 2y agoUSB Serial is such a great thing, finally ending those annoying Electron apps that are only used for one thing. There’s a list of tools that now use the browser to set up devices, and it’s fantastic. ESPHome(+ hundreds projects that use it as a base), Betaflight, ELRS, Flipper just to name a few. I understand that WebKit lacks support since it’s developed by Apple, and I would also be cautious if it granted any access to peripherals. But Firefox? Firefox has severely lacked support for hardware "connections" and has been unfriendly for developers for a long time, so I simply stopped using it (one of the reasons). Reason they state for not adding support it is that user consent is not enough to access the device, which is just nonsense, they could have made it enabled under the developer flag or similar. Blink proved that it can be made secure. I have a filling they are stubborn for no reason and are not seeing use cases that would make their browser usable. https://developer.mozilla.org/en-US/docs/Web/API/Serial https://developer.mozilla.org/en-US/docs/Web/API/Serial https://mozilla.github.io/standards-positions/ https://mozilla.github.io/standards-positions/
- vbezhenar 2y agoIt should be easy to fix that with browser extension and small native program. Nobody wrote this yet?
- pjc50 2y agoWait, under what circumstances are browser extensions allowed to communicate with anything outside the browser?
- vbezhenar 2y agohttps://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... But more generally you can just run webserver on 127.0.0.1 and interact with it from extension (although I didn't test this particular use-case, it works fine from website, but extension might have its own nuances).
- 2y ago
- Devasta 2y agoMaybe I'm just in the minority, I just don't see what purpose this serves. Besides my mouse, I just don't have anything that uses USB. My phone generally isn't connected, I've not needed a USB drive in years and I struggle to think of a situation where I have a product that uses USB that I need to use my laptop for but also don't want the software controlling it installed on that laptop.
- pests 2y agoGoogle unlocking the Stadia controllers via a website was nice.
- ryukoposting 2y agoThis is a good point that tends to get drowned out by the severe privacy and security concerns. WebUSB provides zero value to the overwhelming majority of end users, and minimal value to the handful of us who have ever used it at all.
- kristofferR 2y agoThat's not true at all, flashing ESP32 devices has been made WAAAAAY easier with WebUSB than before. Many keyboards have stopped requiring installing third-party software/drivers to customize them after WebUSB became a thing. The benefits are huge.
- swiftcoder 2y ago> The benefits are huge To a relatively small group of enthusiasts, sure. I'd love to see numbers on the percentage of browser-users who own keyboards which require regular firmware updates..,
- jy14898 2y agoAnother way (I think) is to emulate a USB headset and play/listen to data encoded in audio
- tanepiper 2y agoA few years back I wrote a WebSerial/WebUSB app for fun - https://web-serial-app.netlify.app/ https://web-serial-app.netlify.app/ It still throws a 'Blue screen of Death' for Firefox
- akimbostrawman 2y agoWhile I can understand the drama and criticism surrounding the "standard", using it to flash GrapehenOS on Pixel phones has been one of the most pleasant, easy and fast OS installations experiences i ever had on any device. Literally plug, click and play.
- swiftcoder 2y ago> encrypts the private key with the "master" key, and returns the encrypted private key as the key handle wow. I guess that does work. I feel like giving an adversary infinite opportunity to try and decrypt the private key in their possession will backfire eventually, but what do I know?
- slater 2y ago[NSA with their multiple quantum computers has entered chat] /s
- lxgr 2y agoGood thing AES is quantum-safe, so quantum computers are completely irrelevant when it comes to symmetric key wrapping.
- lxgr 2y agoIt's exactly as risky as any other possible stateless authenticator implementation, if you think about it. For example, another way of doing it is to derive the private key from the key handle via deterministic key derivation – which the attacker can brute-force just as well as the encrypted per-site key stored in the key handle. The key insight is that a stateless authenticator is by definition globally (i.e. across secrets and sites) deterministic, and given an input-output pair, you'll be able to brute-force its internal secret. The solution is to make that internal state large enough for that to be computationally infeasible.
- lxe 2y agoThis is the reason I don't use firefox and opt for Edge instead. Mozilla's ridiculous stance on WebUSB, WebSerial and other web-forward tech is bizarre. It shuts out a huge hobbyist community and diminishes web as a platform.
- miohtama 2y agoMeanwhile, the other half of Hacker News community complains web browsers have too many features and want go back to Web 1.0.
- schmidtleonard 2y agoThe classic balancing act between minimizing attack surface vs "if it can't be used, it can't be abused."
- izacus 2y agoOr a classic selfish "I don't use it so noone else should have it".
- whizzwr 2y agoThat's just 75% of HN or rather "privacy-focused" tech enthusiasts. The remaining 25% hide under the disguise of generic security "concern" that usually involves tangential topic. Case in point: A: WebUSB has privacy risk, it can fingerprint you. B: But it already require user consent. C: ProcesD to pontificate about good user consent UX.
- 85392_school 2y agoWeb Bluetooth and the File System API are among other APIs not supported by Firefox.
- lxe 2y agoExactly... making Photopea's UX worse.
- tekchip 2y agoThe benefit to folks who flash devices frequently is obvious. However, joe user, the other 3 billion or so users couldn't care less. Poking holes in the sandbox for those folks is negligent at best. Perhaps the solution is a separate tool, maybe just a separate browser, specifically for this use case? Flash Browser, heck it could even come with additional tools to help do this. Preconfigured white or black lists, bookmarks to the most common flashing tools, reference material. Make it an even better experience than bolting webusb on to the browser raw.
- lxgr 2y agoWow, U2F already encapsulates its protocol messages in USB HID messages for compatibility, as far as I understand – so now we can encapsulate arbitrary protocols in U2F messages? Beautiful. I hate it. But I also love it.
- Aurornis 2y agoThis comment section is a fascinating mix of people who use WebUSB talking about how great it is and people who don’t use WebUSB being confused about why anyone would want it. In my experience it’s been great. Most of the WebUSB utilities I use are also available as self-installed apps, but I use them so infrequently that it’s much easier to use the web version than to go through the process of installing an update and using the app. It’s also one less app I have to install. I would have expected this to be popular with the people who are tired of having an app for every different thing.
- wazoox 2y agoYeah, except that someday the site that provide that useful app may be gone once and for all, while the app would remain just fine until you uninstall it. So it's a double-edged sword.
- diggernet 2y ago> may be gone once and for all ...and the domain taken over by a scammer who puts up a fake app that does unspeakable things to your USB device.
- SunlitCat 2y ago> does unspeakable things to your USB device Taken out of context (and meaning), this sounds kinda naughty! :D
- anon7000 2y agoThe app they make would probably be Internet enabled with electron so… prolly also won’t work
- xiconfjs 2y agoEverything is a double-edged sword - even a single-edged sword.
- croes 2y agoI‘m more concerned about security by giving a webbrowser too much access to local resources. Convenience and security don’t fit together
- RKFADU_UOFCCLEL 2y ago[dead]
- hackernudes 2y agoQuick summary. Firefox does not support talking to arbitrary USB devices (whereas Chrome has WebUSB to do that). However, Firefox does support talking to U2F security keys over USB. This project programmed a microcontroller to pretend to be a U2F security key. The goal was to talk to the microcontroller over USB through Firefox. They use the Javascript Credentials APIs (https://developer.mozilla.org/en-US/docs/Web/API/Credential_Management_API https://developer.mozilla.org/en-US/docs/Web/API/Credential_...) and some cleverness to send data to and receive responses from the microcontroller.
- sedatk 2y agoYes, this isn't for accessing arbitrary devices. It can be used to build custom devices that can be used by webpages without any consent prompts though.
- nine_k 2y agoBut possibly this MCU's firmware can be expanded to serve a WebUSB lookalike of sorts?
- owebmaster 2y agoso if I understood it right, Firefox is vulnerable to the problem they wanted to avoid but without giving us WebUSB?
- kevincox 2y agoNo, because the device they are accessing needs to be specifically built for this use case. So you would need to give the user a malicious device then use a malicious webpage. The attack scenario isn't impossible, but is far less then those that are possible with WebUSB.
- contravariant 2y agoWhile not impossible, I just can't think of a good reason why you'd need them to access a malicious webpage when you've already gotten them to install a malicious device.
- mortalkastor 2y agoThis is nothing new. Up until ~5 years ago, hacking U2F to make it pass (smuggle?) arbitrary data was exactly how hardware wallet like those from Ledger and Trezor were communicating with websites and web extensions (like Metamask), for the lack of a better alternative. This is how hardware secured "web3" came to be.
- beezle 2y agoIsn't this similar to why most people turn off UPnP on their routers and other similar devices, for security reasons?
- stockhorn 2y agoCouldnt we add some "usb descriptor flag" which says whether WebUSB should be allowed or not? Then firefox/chrome would not need to maintain a blocklist.
- franga2000 2y agoA bit OT, but most of this thread seems to be generally about WebUSB, not the OP (although it is a pretty cool hack!) On one hand, I really want WebUSB, but at the same time, I REALLY don't want the average person to have WebUSB. Practice has shown that consent popups do not work and people will manage to give consent to anything without even realizing it ("I never clicked on anything", they say, while I swipe away 50 spam push notifications and remove push permissions from about a dozen "news" sites). Honestly, I kind of like the Internet Explorer version of permissions, where you needed to mark certain sites as "trusted" to enable certain features. The process is hard to discover, takes a decent amount of time, is a bit confusing, done in a system-styled modal popup with reasonably scary and large warning icons. If people had to go through this process to mark a site as "trusted" in order to use WebUSB, WebBluetooth, and the other dangerous APIs, far fewer would do it by accident. The UX would still be better than installing a native app and you get sandoxing as a bonus, so I think the tradeoff would be worth it.
- ocdtrekkie 2y agoI agree. One of the biggest things people don't understand is that most users simply don't understand what they're doing, and Google does not understand how to design software safe for them. Annoying processes seem pointless but often they have a very clear point: Making sure intent is solid. Apple recently implemented some web APIs in a strategy that shows they actually understand designing for people: The APIs only work if you "install" the website. It makes it possible to access useful PWA features... but it doesn't allow any arbitrary website to do so, there's an extra process normal humans understand to enable it. An installed PWA is also persistently visible: It's on the homescreen. So it's a visible reminder of that permission grant and a clear sign of something a user wants to have some sense of access to them.
- LoganDark 2y ago> Google does not understand how to design software safe for them The only way to design software safe for Idiots is to design software where it is not possible to make a mistake, not possible to have an accident, and not possible to compromise anything even on purpose. Unfortunately, non-Idiots don't tend to appreciate that kind of babyfied experience, so we tend to end up with some compromise where the things that Idiots will inevitably mess up should ideally be the least consequential possible things that can also provide some sort of value to non-Idiots. As a result some of the more advanced experiences that are entirely inappropriate to grant Idiots are simply not available, because if they were, then Idiots would find a way to cause really bad accidents.
- accelbred 2y agoWhy can't webusb be implemented as an extension using a native messaging host?
- aboardRat4 2y agoA web browser is a tool to download HTML documents and render them for reading. Javascript is a language to add animation to those documents.