3 ms·

I‘m more concerned about security by giving a webbrowser too much access to local resources. Convenience and security don’t fit together

• moffkalast 2y ago
  Almost as if we've got some kind of notification that asks you if you want to give a browser access to a certain device huh?
  • croes 2y ago
    Because browser never have bugs.
    • OneDeuxTriSeiGo 2y ago
      If a web browser has a sufficient bug to allow access to webusb without permission in an exploitable way, it's probably also exploitable enough that even without webusb you'd have hardware access via RCE.
• kccqzy 2y ago
  Yeah but if I need to talk to a local device, I trust browser's security far more than a random vendor's native app. I recently bought a keyboard that allows remapping keys; the vendor has both a native app and a web app to do it: I trusted the web app far more.
  • croes 2y ago
    So you don’t trust the vendor. Maybe using their hardware isn’t a good idea in the first place. I think browsers are the bigger target and they provide the much bigger attack vector given that the purpose is being connected to the internet. Using an internet tool to access local resources is using the wrong tool for the job.
    • lukan 2y ago
      "Using an internet tool to access local resources is using the wrong tool for the job." Browser technology stopped being internet tech only quite a while ago. It might not have been the best idea, but that's where we are. So my first choice would nowdays also be webusb if possible.
      • croes 2y ago
        > Browser technology stopped being internet tech only quite a while ago. That was already a bad idea. > It might not have been the best idea, but that's where we are. You aren’t forced to use it for local resources.
        • lukan 2y ago
          No I am not forced to use it, but since the web is my usual tech stack, I likely will just use that, if I ever have to connect to a USB device.
          • croes 2y ago
            If you write code ok, but what about third party apps. Supply chain attacks are quite common.
    • kccqzy 2y ago
      Maybe I'll believe you when desktop operating systems have a mature and easy-to-use sandbox for local apps. Any random local app by default having access to ~/.ssh/id_rsa no attack required is a much bigger threat for me to worry about than thinking a web app might attack my browser to steal data belonging to a different origin.
      • jimmaswell 2y ago
        Run it as another user or put it in a less privileged cgroup. Problem solved.
  • accelbred 2y ago
    Agreed. Therefore I use niether webUSB or vendor apps but rather use hardware that works with openocd and open source tooling.