3 ms·

Fingerprinting, basically, and whether browsers should gain any more capabilities at this point which just deepens the dependency on Chrome further and further.

nicce 2y ago
About fingerprinting - was the WebUSB made poorly? I believe the device information can be strictly restricted and given only on user consent. E.g. by default browser sees only plugged-in status of certain device categories.
- vbezhenar 2y ago
  You don't see anything without user consent.
  - nicce 2y ago
    It works like that or you think it should work like that? If browser gets zero information, it drastically reduces UX. It even does not know to suggest permission popups without being misleading in the end.
    - vbezhenar 2y ago
      I don't think, I wrote enough code with those APIs. You call `navigator.usb.requestDevice({filters})`. It returns a promise and browser displays a window with device list according to the given filter. User chooses device or presses "cancel". The promise resolves with single device or rejects with error. You can't fingerprint anything without user interaction. Also there's block list which does not allow to connect to keyboard, mouse, so typical user does not even have any USB devices to choose from.
- deleted 2y ago
  [deleted]
swiftcoder 2y ago
While fingerprinting is a concern with many web extensions, the bigger problem here is the security risks inherent in exposing on the open internet a bunch of USB devices that were not designed with adversarial inputs in mind...
- tannhaeuser 2y ago
  I think you're right. Weren't there even remote DMA/CPU-level attacks over OHCI/USB?
rs186 2y ago
I think that ship sailed many years ago. As I user who cares deeply about privacy and has almost everything enabled -- "strict" anti tracking protection on the browser, uBlock origin, DNS level filtering etc -- I discovered that any the fingerprint for my Firefox is pretty much unique on the entire Internet. One thing that astonished me was that the number of hardware cores of my CPU is easily accessible from JavaScript. I have an AMD machine with 8 cores and 16 threads. Somehow it is on the high end of machines that access the Internet, and only a small fraction of users have a 8 core CPU. Combined with just a few other parameters, especially IP address, it is easy to uniquely identify this computer. Just one additional channel of information from WebUSB barely matters at all.

nicce 2y ago

About fingerprinting - was the WebUSB made poorly? I believe the device information can be strictly restricted and given only on user consent. E.g. by default browser sees only plugged-in status of certain device categories.

vbezhenar 2y ago
You don't see anything without user consent.
- nicce 2y ago
  It works like that or you think it should work like that? If browser gets zero information, it drastically reduces UX. It even does not know to suggest permission popups without being misleading in the end.
  - vbezhenar 2y ago
    I don't think, I wrote enough code with those APIs. You call `navigator.usb.requestDevice({filters})`. It returns a promise and browser displays a window with device list according to the given filter. User chooses device or presses "cancel". The promise resolves with single device or rejects with error. You can't fingerprint anything without user interaction. Also there's block list which does not allow to connect to keyboard, mouse, so typical user does not even have any USB devices to choose from.
deleted 2y ago
[deleted]

swiftcoder 2y ago

While fingerprinting is a concern with many web extensions, the bigger problem here is the security risks inherent in exposing on the open internet a bunch of USB devices that were not designed with adversarial inputs in mind...

tannhaeuser 2y ago
I think you're right. Weren't there even remote DMA/CPU-level attacks over OHCI/USB?

rs186 2y ago

I think that ship sailed many years ago. As I user who cares deeply about privacy and has almost everything enabled -- "strict" anti tracking protection on the browser, uBlock origin, DNS level filtering etc -- I discovered that any the fingerprint for my Firefox is pretty much unique on the entire Internet. One thing that astonished me was that the number of hardware cores of my CPU is easily accessible from JavaScript. I have an AMD machine with 8 cores and 16 threads. Somehow it is on the high end of machines that access the Internet, and only a small fraction of users have a 8 core CPU. Combined with just a few other parameters, especially IP address, it is easy to uniquely identify this computer. Just one additional channel of information from WebUSB barely matters at all.