I-cant-believe-its-not-webusb: Hacking around lack of WebUSB support in Firefox

But possibly this MCU's firmware can be expanded to serve a WebUSB lookalike of sorts?

No, because the device they are accessing needs to be specifically built for this use case. So you would need to give the user a malicious device then use a malicious webpage. The attack scenario isn't impossible, but is far less then those that are possible with WebUSB.

No, USB is vulnerable to malicious devices.

Yeah but if I need to talk to a local device, I trust browser's security far more than a random vendor's native app. I recently bought a keyboard that allows remapping keys; the vendor has both a native app and a web app to do it: I trusted the web app far more.

Almost as if we've got some kind of notification that asks you if you want to give a browser access to a certain device huh?

The app they make would probably be Internet enabled with electron so… prolly also won’t work

> may be gone once and for all

...and the domain taken over by a scammer who puts up a fake app that does unspeakable things to your USB device.

You could add a little hardware button or toggle switch to the board to enable/disable flash drive emulation if you really wanted to be secure. Write your config, unmount, flip toggle switch.

Yep, this is my current workflow -- not the easiest, but the one I trust the most

I think the third is scroll lock [1].

That one feels quite legacy to me, every time I active it it's by accident and I don't understand why stuff is behaving weirdly.

[1]: https://en.wikipedia.org/wiki/Scroll_Lock

I can’t just set any key to output the unicode character I want. I know there are some Linux only hacks, but it would be nice to do in a standard way.

You can't manipulate capslock state from JS.

Because the browser interacts with my camera/mic through specific media APIs that don't allow it to flash the firmware.

The browser itself shouldn't have access to raw devices, as that means giving all programs running under your user the ability to flash your keyboard firmware.

The point of flatpak, wayland, etc is to prevent software from having access to everything. Making all USB devices readable and writable again circumvents the entire sandboxing concept of modern systems.

Windows and macOS allow access to USB devices for user programs. Linux by default does not allow access to USB devices, you need to chmod corresponding pseudo-file in /dev (or write udev rule to make it happen automatically). So when one uses WebUSB (or any other usb software) without root, it won't work immediately.

taking this from vial website

``` export USER_GID=`id -g`; sudo --preserve-env=USER_GID sh -c 'echo "KERNEL==\"hidraw\", SUBSYSTEM==\"hidraw\", ATTRS{serial}==\"vial:f64c2b3c*\", MODE=\"0660\", GROUP=\"$USER_GID\", TAG+=\"uaccess\", TAG+=\"udev-acl\"" > /etc/udev/rules.d/99-vial.rules && udevadm control --reload && udevadm trigger' ```

so that means the device can be read and written by the user and group, but not by others.

i'm just guessing here but maybe only chrome is asking that. if the malware is another program, no confirmation is required?

> Everyone loves the fact the browser is a secure sandbox, letting users run untrusted code. I don't get why people want to poke so many holes in the sandbox.

My thoughts precisely. I want browsers to be welding holes shut, not opening new ones.

I’d think differently if user consent were required to load any scripts past a certain complexity threshold (e.g. if they’re heavier than that of an early-mid 00s website, hold off on execution until the user approves), but with how easily users can be taken to sites they never asked to go to every added bit of deep system integration a browser gains is a massive liability. The web is too built up around the idea of implied consent to be doing anything too fancy.

I thought WebUSB required you to explicitly select a USB device from a list to allow the web page to connect to it?

> I don't get why people want to poke so many holes in the sandbox.

Because what's a sandbox to you is an universal API layer to some.

Google should've asked me first, cause just seeing the name WebUSB, I said "wtf why is this even a thing, absolutely no."

Imagine if those devices used proper USB descriptors/classes instead of generic HID device.

Is is really handy if you have a programmable keyboard that use a web configurator/firmware builder. E.g. ZSA's Oryx. Downloading the firmware and then flashing with another program gets old pretty quickly.

That said, I don't really like the browser having USB access, etc. I agree that the potential privacy/security issues are not worth the comfort it provides.

(Yes, I know you can script your way around it by monitoring a download directory, etc.)

> I can count the times I've needed WebUSB or WebSerial on one hand

There are many things that would be possible with WebUSB that current browsers make impossible. My personal example is label printers: I would love for my SaaS app (PartsBox, https://partsbox.com/) to be able to print labels, but there is no way to access a printer from a browser other than through the "Print…" dialog, which is no good if you need to send ZPL2 commands to a Zebra label printer.

WebUSB is not necessarily the best imaginable solution to that problem but it would help.

I don't want to tell my users to use Chrome. But Firefox doesn't make my life easy (see also https://bugzilla.mozilla.org/show_bug.cgi?id=896666 — a bug opened 12 years ago, about Firefox closing websockets when the user clicks a download link).

What are the fingerprinting risks? Can websites gather any data without user consent?

I used WebUSB to flash GrapheneOS onto my Pixel, and to flash WLED on an ESP32 and it felt like magic. I'm erring on the side of this being a net positive.

My experience with WebSerial/WebUSB/whatever I used (I don't know) is:

- go to espresense.com

- hook up an esp32 via usb

- click connect, click flash

- done

- repeat 10 times for all the base stations I needed

It reduces the friction of flashing a dev board to ~0. I absolutely loved it. I'm only annoyed that I had to open Chrome to do it (my daily driver is Firefox).

>don't need to download an electron app to interact with physical hardware.

I don't need to download an Electron app to interact with physical hardware, full stop, WebUSB or not.

Is that where we're at now? That writing a small utility to configure a widget over serial in platform native tooling is beyond us?

Fingerprinting risks? Is there some device enumeration capability that I don't know about? I thought you had to explicitly grant access to the specific supported device in a browser popup window.

The fingerprinting risks, to a layman, seem to be a red herring?

Have the user consent occur before the point of enumeration.

Or lock it behind the user already having installed the pwa and require confirmation (i.e. a browser site gets a flat denied message, a installed PWA gets a permission prompt).

Sort of depends on Firefox supporting installing PWAs though..

For webserial this feels like it would make sense... WebUSB does feel like an overreach and too much.

- Firefox addon to add WebUSB capabilities

Note this is beyond the capabilities of web extensions, you'd also need the user to install a cooperating native program.

At which point people are just going to make the native program an electron UI and bypass the browser entirely.

I don't exactly understand the privacy and security implications here.

A website can prompt for precise location at any point. A website can prompt me to provide a certificate with my cryptographically proven identity at any point. A website can PROMPT for XYZ at any point.

Why should WebUSB be treated any different. If I give access to a device, I give access to a device. If I don't, they can't touch or identify it.

> Google cannot make this into a web standard unilaterally

At their market share, what's the downside to them of something remaining Chrome proprietary forever?

There are more than twice as many Linux desktop users than there are firefox users in total. People have left firefox for many reasons. The incompetence, user hostility, lack of principles, and technical lag are rampant and pervasive.

Even seemingly trivial missing features can push people to another browser if they're otherwise largely indifferent already.

I don't think it's unreasonable to assume that to some people, the inconvenience of juggling two browsers alone outweighs the benefits of using Firefox for most browsing.

Neither can I, but you know what I can imagine? Walking away from Firefox because it yet again shows it has no interest in being a strong browser for the only folks that actually use it, namely power users who care about privacy, security, and controlling their own browser experience while enabling them to make the coolest shit with the latest, cutting edge Web APIs.

"Leaving Firefox" because of WebUSB would be silly, but "finally leaving Firefox" because they refuse to add yet another thing that intersects with your interests? Absolutely. At some point you just have to go "this is an abusive relationship holding me back".

It's not an either-or thing. Every case of WebUSB flashing I've seen also offers an open source CLI tool you can pull down and use instead.

I like the sandboxing properties of my browser, and wish I could run as many of my local applications and utilities in it or in something comparable.

Part of that is being able to access hardware, and missing that functionality will expose data on my computer to malicious or compromised applications or scripts.

Hardware access obviously has to be on a very strict opt-in basis. For all the things Apple is regularly trailing behind other browsers or outright botching, I think letting only "installed PWAs" send push notifications and persist state more than 7 days between visits is directionally the right thing to do, and hardware access would be much less critical limited that way.

I'd read it more as "I don't particularly care about what ends up as the standard or who ends up writing it, I just wish that it's nearly as capable as the non-standard implementation that exists and is useful."

Mozilla's objection is to having the capability at all, on the basis of "USB devices are too easy to hack" and "users are too dumb to give informed consent, regardless of what we tell them". And GP's objection to Mozilla's objection ultimately comes down to having the capability or not.

WebMIDI has been used by porn sites to track users:

https://news.ycombinator.com/item?id=23679063

Webmidi is godsent for Akai LPD8 controllers. It came with software that's used to reprogramming midi banks. Software never got updates and doesnt work anymore in any modern mac. Thank $deity for webmidi and some reverse engineering, i can reprogram it to a degree that its at least functional and dont need to throw it away.

Good thing AES is quantum-safe, so quantum computers are completely irrelevant when it comes to symmetric key wrapping.

[flagged]

> I don't see why any website should need special direct access.

And this also holds back things like better security from USB security keys.

You have to access the key in exactly the way that is implemented ... even if that implementation sucks or has bugs or has security failures.

Everybody hates Electron .. but then want to hamstring the browsers. Well, people still want do do the thing they want even if you don't let them. They will find a way around .. and currently that way around is Electron.

If history teaches us anything, it's the fact that we will come full circle, the browser will become the os at some point. People with money want it to happen and they have resources to make us think that we want it too. Might as well enjoy the ride

While fingerprinting is a concern with many web extensions, the bigger problem here is the security risks inherent in exposing on the open internet a bunch of USB devices that were not designed with adversarial inputs in mind...

I think that ship sailed many years ago.

As I user who cares deeply about privacy and has almost everything enabled -- "strict" anti tracking protection on the browser, uBlock origin, DNS level filtering etc -- I discovered that any the fingerprint for my Firefox is pretty much unique on the entire Internet.

One thing that astonished me was that the number of hardware cores of my CPU is easily accessible from JavaScript. I have an AMD machine with 8 cores and 16 threads. Somehow it is on the high end of machines that access the Internet, and only a small fraction of users have a 8 core CPU. Combined with just a few other parameters, especially IP address, it is easy to uniquely identify this computer.

Just one additional channel of information from WebUSB barely matters at all.

About fingerprinting - was the WebUSB made poorly? I believe the device information can be strictly restricted and given only on user consent. E.g. by default browser sees only plugged-in status of certain device categories.

It already does though. It's the type=upload box we've had for decades. Think of it as how smartphones let you give access to only a specific file or see a subset of files. The "UI" is just using a system control. You can also drag and drop files into the browser too. This is all available to javascript.

In this case, Safari also doesn't implement the API, and that's far from an ant. Plenty of cases where something is effectively everywhere but in Firefox, but this time Apple also decided against it.