Hacker News Reader

Comment by lpcvoid | Hacker News Reader

How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.

View on HN

Isn't that the same excuse Gooogle is using to lrevent folks from installing what they want on Android phones?

Essentially, yeah.

I do not agree with Google on preventing apk installation. But unknown apk is a different risk profile than letting unknown entities to access local usb devices.

The main issue in the former case is that google is posing itself as a gatekeeper instead of following a repo model like Debian or FreeBSD. That’s wanting control over people’s device.

Allowing USB access is just asking to break the browser sandbox, by equating the browser with the operating system.

You can ask them to type one of the following sentences:

"I know what I'm doing, and giving a random website access to my USB host is the right thing to do."

"I'm an idiot."

I love this because the idiots would type out that they know what they're doing and the pros would save time by typing "I'm an idiot."

hah I did think of the second one, but the first didn't occur to me.

You simply don't. This quest of saving idiots from themselves is not gaining anyone anything and meanwhile other people get more and more useless restrictions.

Or you can just not give a loaded shotgun to every browser user on the off chance they need to interact with 1 (one) usb device per year.

Or you can just not use the web at all. If you're so scared of it, why are you using it with browsers that have implemented all kinds of APIs that probably already scare you? You may as well just use the Lynx browser if you really want want to put your money where your (security) mouth is. It doesn't do anything, not even display images or CSS or run Javascript.

I'm tired of my computing being kneecapped in service of incompetent boomers. Enough is enough. If they're going to fall for dumb scams let them.

They can click everything away, so maybe educate them or buy an ios device for your relatives instead of breaking computing for everyone else.

> breaking computing for everyone else

How is not implementing a Draft spec, which may compromise security badly, breaking computing?

Overreacting much?

This is not just an isolated incident, it's the whole trend of limiting capabilities in the name of security and that's what I was referring to.

However in this particular case, even the security argument doesn't hold, either I:

a) know that I want to use USB - in that case I'll switch browsers or download a native binary (even more unsafe), it's not that I'd decide that I no longer want to flash my smartphone

b) I don't understand what's happening but I follow arbitrary instructions anyway - WebUSB changes nothing.

A native binary can be verified by anti malware systems, and once installed and working, poses no security risk.

A 0day in a browser for the WebUSB system would allow any website to mess with arbitrary USB devices connected to your computer.

While the browser sandbox is generally safe, it is also a huge target, and with a security risk like that, it wouldn't surprise me if it's a prime target for black hats.

So instead of using trusted vendors or requiring tools with auditable code, we just allow everyone to be able to access the user’s devices?

What a concept. We could call it "Personal Computing."

Not really that personal when every webpage is itching to put their hands on it.

Fair, but remember that we are the <~1% of people who even know what webusb is. I'm not sure I share your view on this.

Maybe an about:config switch to enable it would be enough to stop casuals from pwning their peripherals.

I’d be ok with an about:config switch, but given that many people will install anything, paste arbitrary text into terminals, and share their password/pin code with complete strangers for almost no reason, I think we need to stop making our tools less powerful in pursuit of an impossible goal.

> They can click everything away, so maybe

So maybe don't populate the browser with dozens of features requiring permission popups?

Reply on news.ycombinator.com