4 ms·
Quick summary. Firefox does not support talking to arbitrary USB devices (whereas Chrome has WebUSB to do that). However, Firefox does support talking to U2F s
by hackernudes 2y ago
Quick summary.
Firefox does not support talking to arbitrary USB devices (whereas Chrome has WebUSB to do that). However, Firefox does support talking to U2F security keys over USB.
This project programmed a microcontroller to pretend to be a U2F security key. The goal was to talk to the microcontroller over USB through Firefox.
They use the Javascript Credentials APIs (https://developer.mozilla.org/en-US/docs/Web/API/Credential_Management_API https://developer.mozilla.org/en-US/docs/Web/API/Credential_...) and some cleverness to send data to and receive responses from the microcontroller.
- sedatk 2y agoYes, this isn't for accessing arbitrary devices. It can be used to build custom devices that can be used by webpages without any consent prompts though.
- nine_k 2y agoBut possibly this MCU's firmware can be expanded to serve a WebUSB lookalike of sorts?
- owebmaster 2y agoso if I understood it right, Firefox is vulnerable to the problem they wanted to avoid but without giving us WebUSB?
- kevincox 2y agoNo, because the device they are accessing needs to be specifically built for this use case. So you would need to give the user a malicious device then use a malicious webpage. The attack scenario isn't impossible, but is far less then those that are possible with WebUSB.
- contravariant 2y agoWhile not impossible, I just can't think of a good reason why you'd need them to access a malicious webpage when you've already gotten them to install a malicious device.
- fhars 2y agoNo, USB is vulnerable to malicious devices.