3 ms·
What an excellent write up. Adding a Web Bluetooth API to the browser to then be later used for "secure" actions like passkeys or logins never made any sense to
by rvz 2y ago
What an excellent write up. Adding a Web Bluetooth API to the browser to then be later used for "secure" actions like passkeys or logins never made any sense to begin with.
How much was this bounty if there was any? Looks like a 7.8 severity CVE [0].
[0] https://nvd.nist.gov/vuln/detail/CVE-2024-9956 https://nvd.nist.gov/vuln/detail/CVE-2024-9956
- lxgr 2y agoFIDO is explicitly blocked in Web Bluetooth for exactly that reason: https://github.com/WebBluetoothCG/registries/blob/master/gatt_blocklist.txt https://github.com/WebBluetoothCG/registries/blob/master/gat... This is similar to how you can't access HID (and by extension CTAP2 or U2F) or CCID (and by extension smart cards such as OpenPGP cards) over Web USB.
- rcxdude 2y agoThis issue is mostly seperate from Web Bluetooth: it'd be an issue even if that API didn't exist at all (though, of course, these APIs make it a little harder to use those interfaces for validating anything, though thankfully not that much harder because it's fairly easy to add some 'hey, this is really a browser and not a web page making this request' signal, as opposed to with QR codes, which are ultimately just a collection of pixels and it's the very-hard-to-evaluate context in which it appears on the device's screen which makes for that seperation.)
- mastersplinter 2y agoSo grad you enjoyed it! Chrome awarded 6000 USD, very grateful for it and will fuel some more security research for a while :)