Hacker News Reader

The problem is that the web browser runs every URL that a user visits and whatever that page links to. This means that it's a privacy risk.

Look at this site which looks at the fingerprintable bits of data that is available from a web browser: https://amiunique.org/fp

The web browser leaks a lot of specific information about the user. Which can then be combined with other information to uniquely track a user on the internet.

Why does the web browser need to make available the list of all fonts on a user's machine? Installing any combination of extra fonts makes you significantly more unique.

Same with GPU model.

The article talks about WebUSB. And how it was used to phish people's Yubikeys:

https://www.wired.com/story/chrome-yubikey-phishing-webusb/

The user isn't consenting to that.

> Why does the web browser need to make available the list of all fonts on a user's machine?

In many cases I think the question is more "what functionality would the web browser need to break to prevent pages detecting X, and is that worth it?".

I remember doing this kind of detection years ago for an (entirely benign) chart authoring webapp; you don't want to offer a font for client-side rendering if the client doesn't have it. You can generally assume that the `monospace` and `serif` fallbacks are different, so if you have one layout box with text in `font-family:FontToDetect,monospace` and another with the same text but `font-family:FontToDetect,serif` and they both come out the same width, it's good odds that the user has that font. [EDIT: originally got that backwards due to brainfart]

Nowadays the existence of `@font-face` makes that particular problem mostly obsolete, but the same general principle applies all over.

> The user isn't consenting to that.

AFAIK webUSB was always behind a consent dialog. That attack was based on getting consent, and the authors seems to say so at a talk about it (or a similar attack): https://www.youtube.com/watch?v=pUa6nWWTO4o

It's still very bad, but not nearly as bad as you say it is.

People keep mentioning the fingerprinting thing, but why is the web special in that aspect? A desktop app has access to a lot more than what the browser exposes. At least with the browser, if they try to access a file, they can’t. Desktop apps on Windows have pretty much free reign on the file system (see ransomware).

Sure, drive by ad tracking is easier with the web, but fingerprinting through desktop apps does exist.

Basically, why should I be forced to download a program that gets more access than a web app gets? Just so privacy advocates feel better about averting another privacy leak that can be prevented by browser permissions (like the webcam is)?

And as a developer, why should I be forced to learn Qt/GTK so I can do something like USB? And if I use Electron, I’m skewered by other developers for writing a bloated mess because I had no choice.

> So how come this gets twisted on its head when it comes to web apps?

It's the Windows 95 security model:

Some things I trust, and I'm happy giving nigh-unlimited power, so I run them natively.

Other things I don't trust, and I want them in a sandbox where they can't mess things up. That sandbox is the browser, and having it be very secure is a high priority for me.

Poking more and more holes in the sandbox, together with a philosophical belief that the inside of the sandbox should be no more restrictive than the outside of the sandbox, is not compatible with that philosophy.

Right, there are effectively only two levels of trust for a typical user: None at all, and Unlimited. Do you really like that model?

That model doesn't work too well for me, I'll give you an example. I want to be able to buy a fun USB gadget (like a fitness tracker) and not have to think about the security implications, but that is difficult right now. I have two choices, I can install the manufacturers sync software, giving it unlimited access to my computer or not use it at all. I trust the manufacturer to access the device they sold me...but I don't really want to give them access to my SSH keys, so my only option is to not use it.

The idea that WebUSB will allow me to visit gadgetvendor.com, grant access to one specific device, and not have to worry about any consequences is really appealing to me. They will have no access to my computer other than to the the device they sold me.

I think the concerns I've read mostly boil down to "what if a website tricks me into granting access to a device I shouldn't have?". It's certainly true we need security UX experts to make sure this is not confusing, but I don't really see how that is any different than a website tricking you into running an EXE.

> So how come this gets twisted on its head when it comes to web apps? The user should be allowed to do what they want, right?

The web needs to be secure against untrusted code, so it makes sense that there might be things you can do in a native application that you can't do in the browser.

> Why should I _have_ to use native apps if I don't want to?

It's not an affront on your freedoms to impose sensible restrictions on browsers' capabilities.

> As a web developer, why do I need to learn Qt or GTK or whatever to ship something useful to end users, when I already know HTML and JS and could easily deliver my product if the right native API was exposed?

If you want to use your web-dev skills to build native applications, there are various frameworks that let you do exactly that. You can call C/C++ functions from Electron. [0] Of course, you also have the option of learning and using C++ for your own GUI code, with frameworks like Qt.

> Remember splash screens? Random freezes? Running out of RAM because some random app in the background decided to malloc 80GB for some godforsaken reason? How is that a better experience than a web app running in a sandboxed tab you could easily kill whenever you want?

This is a straw-man. The people you are caricaturing are just people who want technically excellent software. This includes (but is not limited to) the efficient use of computational resources. No-one is pining for the instability of Windows 98.

[0] https://stackoverflow.com/a/39569062/

> I don't see why web apps should be handicapped

The evidence overwhelmingly shows that given an exhortation to adhere to the principle of least authority, developers opt to pursue their apparent belief in their manifest destiny to control ever more resources on the user's machine and relying on that level of control even when it's not called for regarding the application at hand. It doesn't make sense to repeat the experiment by opening the floodgates in all the browsers and seeing if it'll turn out differently this time. It's also not as if there's a dearth of opportunities for developers to fulfil their desires elsewhere. The Web meanwhile is pretty much the only one doing what it is, and it's not like we can just roll things back when devs unsurprisingly do end up misbehaving in the way they are wont to.

> So why shouldn't I be allowed to use web apps that interact with bluetooth or USB devices? Why should your philosophical arguments on which software on what platform is allowed to do get in the way of my very real productivity and desire to use my computer the way I want to?

This doesn't accurately describe the circumstance we're in. There are no concrete barriers here hindering your productivity by total control over your own machine. Your user agent is just another native app, after all, which you have the freedom to select and run how you see fit. Use one that supports Bluetooth, Dat, or heck, one that gives you script access to directly write to your bootsector if you want. This is a power that has been exercised for years by everyone from end users to IT departments (cf continued use of Internet Explorer). The only real limit you have is in the scenario where you are a Web app author and you're hindered by other people's choice of browser, which is a very different situation from the "my computer" argument you're using. (If you want to cite iOS here, then it's Apple and the App Store model that you have the problem with; there are multiple levels of irony in this.)

I think the danger lies mostly in apps that both access my data and hardware and the web. For local apps accessing hardware or data, I can often control whether it sends that data elsewhere.

A web app almost by definition uses the network, so if I give it access to my camera or my file system then it’s very hard to know exactly if or where that data is sent.

This isn’t perfect for native either, the dialog to accept network usage is basically a blanket grant to connect anywhere or send anything.

Exactly. But for the savy it's easier to see from network tab in dev tools where your data is sent.

No such luck with native apps. I don't almost never use wireshark to figure out what my native apps are doing.

Also. The entire argument falls apart when you factor in the ability to proxy data. E.g google.com -> bit-shady-site.com -> for-sure-shady-site.com

>> I don't see why web apps should be handicapped compared to their native versions.

For starters, native apps have too many permissions already.

Second, if you run a native app it should require explicit permission for internet access (perhaps at install time) so you have some idea if local data is going somewhere. Web apps are implicitly assumed to have internet access.

This should be fairly obvious, and the notion of granting more local access to arbitrary outsiders should be distressing. The fact that google and web sites feel entitled to everything on and about you computer says a lot about them. If they were humans with that lack of boundaries and sense that what's yours is theirs, we'd label then narcissists or psychopaths (not sure which).

Indeed, OSes already have privilege access mechanisms like GPO on Windows and SELinux / AppArmor / Flatpak on Linux to restrict installed binaries.

Then all that goes out the window when the 100 MiB gorilla named /usr/bin/browser wants access to everything anyway, connects all that privileged information to other people's computers, and then implements its own entirely separate privilege access mechanisms in userspace to make that secure.

Yet we are as of right now where even our OS will go behind our back and act like malware to collect data even when we explicitly say no.

The native apps are also all trending to online first and cache offline.

I don't understand how a native app going behind your back and asking only for internet connection permission (and not hardware) is viewed as more secure. Why do we trust these native apps more?

Arbitrary psychopathic outsiders have already been here for quite a while. Even if you're running super paranoid homebrew linux distro.

I agree that it doesn't need to be about security. If web apps had to be installed on browsers similar to the way they are installed on the operating system, they would be acceptable. The current system that they run automatically when you visit a web page is obviously unacceptable, but that could be changed. The lack of standards and GUI features is also not that bad.

For me it's more about pricing and freedom. Server and computing costs force most web apps to be subscription-based and I'm extremely picky about subscriptions. First, there is often data lock in, of course, and it's often very deliberate with no viable export options. That's unacceptable to any reasonable person both on desktops and with web-based apps. Second, subscription-based applications are universally too expensive. If I turned all desktop software I currently use into equivalent subscriptions my monthly bill would be insanely high, an additional 200 to 500 euro per month. To most people including me that's just not affordable. It just doesn't add up. There is no market where people buy 20 different apps at $15/month each.

Almost everyone uses free desktop apps and a few paid ones.

> I agree that it doesn't need to be about security

This.

You're litterally using a personal computer with at least personal data on it, passwords in a password manager, passwords in your browsers, website account sessions (!) all on your drives and folders. Everything accessible by ALL programs you execute.

The more info Javascript has and therefore the server, the more attack vectors open up to just inject code into your browser and leverage code execution on host (recent CVE on firefox and Chrome !).

Or into your slack electron's chrome. Or any spyware app.

All your keystrokes accessible also !

Consider using a virtual machine or container to isolate the apps from your data so that they can't access it. If needed, mount a folder between host and guest for purpose-only sharing.

Or at least think about it or other measures.

> If it was as easy to download, install, and run native apps, we would be having the same exact conversations in regards to security and portability.

Mobile platforms have invested in restricting apps by ability. There's no such way to exert this control over web apps with current browsers.

For instance, how to you stop a page from snooping your keystrokes? At best you can disable javascript entirely.

The browser really, really, really needs to adopt the sandbox model used by the rest of the operating system for this to make any sense, and right now the browser is more of a gaping hole in your wall than a sandbox.

> The user should be allowed to do what they want, right?

You'd need to do a hell of a lot of footwork to actually enable users to make decent decisions about random code found on the internet. I don't trust anyone technical I know to do this, much less people who don't understand what's going on.

I'm not sure what you mean, a webpage can't just randomly snoop on all your device's keystrokes if you don't have it open AFAIK. Do you have an example of this?

Browsers already use a sandbox + permission model very similar to mobile. A webpage can't just silently obtain your location data, for example, it has to ask permission first. Any hypothetical hardware API will probably use the same permission flow.