Hacker News new | ask | show | jobs
by Ajedi32 3029 days ago
It's simple: allowing sandboxed code to request limited access to a USB device is more secure than having users install native, unsandboxed code with access to everything on their PC.
2 comments

Assuming the sandbox works. If the sandbox is porous, the attack surface balloons from apps I choose to install to every link I click.
Not every link you click. Only sites that you grant access to the necessary attack surface. The Web USB API can't be attacked by sites that you haven't granted access to it.
What if that privileged website has XSS vulnerability?
Then the attacker gets access to that USB device. (And only that USB device.)

What if your unsandboxed native USB utility has an RCE vulnerability?

As opposed to native desktop apps, which get all the same permissions by default that a web app requires a zero-day sandbox escape vulnerability to achieve?
Native desktop apps are limited in number are nowhere near the dumpster fire the web is. My desktop isn't routinely downloading and executing payloads from the web. They're clearly different.
This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw).

It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to your PC and execute it? Or execute some JS in the browser sandbox and grant it limited access to that one specific device?

There are operating systems which don't by default give every application running as every user account access to every storage device.
>if you ever found yourself in a situation where you needed to connect a USB device to a remote service

I have never found myself in that situation. That sounds like a really silly idea.

Then click "deny", or (in the case of a native app) refuse to install the executable. Either way you're safe.

For those that _do_ require [such use cases][1] though; they can now do so without needing to expose their system to an unsandboxed native app.

[1]: https://wicg.github.io/webusb/#motivating-applications

Just because you've never dreamed up a situation where it might be useful doesn't mean that they don't exist.
Attaching a bootable USB drive to a HTML5 based KVM? Sure it could be accomplished in other ways buy why not this way?