[jorvi]

Well, formerly you would have been right, but WebUSB and whatnot are gaining a lot more traction.

I didn't take WebUSB seriously until I steered someone to flashing a small firmware onto something and they could do it straight from the browser! And it was a nice workflow too, just a few button and a permission click.

Two other examples I can think of are flashing Via (keyboard) firmware and Poweramp using WebADB via WebUSB to make gaining certain permissions very easy for the layman. I imagine it's gonna get more and more user in enterprise too.

Firefox is seriously behind by refusing to implement it.

[dns_snek]

WebUSB is a giant gaping hole in the browser sandbox. Innocent use cases are really nice, I've used WebUSB to flash GrapheneOS on my device, but the possibilities for users to shoot themselves in the foot with nefarious website are almost endless.

Consider the fact that Chromium has to specifically blacklist Yubikey and other known WebAuthn vendor IDs, otherwise any website could talk to your Yubikey pretending to be a browser and bypass your 2FA on third party domains.

I'm conflicted on WebUSB because it's convenient but on the balance I think it's too dangerous to expose to the general public. I don't know how it could be made safer without sacrificing its utility and convenience.

[jorvi]

It really isn't. Chromium (since 67) does USB interface class filtering to prevent access to sensitive devices. Then there is the blacklist you mentioned.

On top of that, straight from Yubico's site:

".. The user must approve access on a per website, per device basis .."

This isn't any more a security hole than people clicking "yes" on UAC prompts that try to install malware.

[dns_snek]

> ".. The user must approve access on a per website, per device basis .."

Of course, but a phishing website "fake-bank.com" could collect user's username, password, and then prompt them to touch their yubikey. This wouldn't trigger any alarm bells because it's part of the expected flow.

> This isn't any more a security hole than people clicking "yes" on UAC prompts that try to install malware.

Yes it is. The only reason why Yubikeys are immune to phishing and TOTP codes aren't is because a trusted component (the browser) accurately informs the security key about the website origin. When a phishing website at "fake-bank.com" is allowed to directly communicate with the security key there's nothing stopping it from requesting credentials for "bank.com"

[jorvi]

Again, that exploit factor is irrelevant now because WebUSB is blacklisted from accessing, among other things, HID class devices. So no site, even with permission, can access U2F devices over WebUSB. There is no special blacklist needed per vendor or anything.

You are right that it was a security hole in Chrome <67. Which is almost a decade in the past by now.