Hacker News new | ask | show | jobs
by lstodd 1681 days ago
WebUSB is insane security-wise.

About the only worse thing would be a WebPCIe.

3 comments

Don't give them ideas. Also, with Thunderbolt, USB is pretty much just a transport for PCI-e.

Edit, here's how Google justifies the existence of WebUSB (https://web.dev/usb/):

"""

Let's see the behavior you could expect with the WebUSB API:

1. Buy a USB device.

2. Plug it into your computer. A notification appears right away, with the right website to go to for this device.

3. Click the notification. The website is there and ready to use!

4. Click to connect and a USB device chooser shows up in Chrome where you can pick your device.

"""

The goal is to make Chrome the OS. As long as your USB device works on Chrome, who cares about it working on the rest of the system. Absolute madness.

I mean isn't it a lot more manageable than things like PCIe that support DMA.

Given the seemingly extensive support for doing emulated USB passthrough/redirection to VMs, I'm assuming people have looked into the security implications to the host.

Be careful what you wish for, USB4 supports PCIe tunneling. Looks like we're just a slippery slope away.