News for hackers. Stuff that matters.

A comment on Chrome lets hackers phish even 'Unphishable' Yubikey users. Parent comment

Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Ajedi32 on Friday March 02, 2018 @02:46PM (#16504980)
This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw).

It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to your PC and execute it? Or execute some JS in the browser sandbox and grant it limited access to that one specific device?

[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by cestith on Friday March 02, 2018 @04:14PM (#16505749)
There are operating systems which don't by default give every application running as every user account access to every storage device.
[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Sir_Cmpwn on Friday March 02, 2018 @02:51PM (#16505034)
>if you ever found yourself in a situation where you needed to connect a USB device to a remote service

I have never found myself in that situation. That sounds like a really silly idea.

[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Ajedi32 on Friday March 02, 2018 @03:11PM (#16505242)
Then click "deny", or (in the case of a native app) refuse to install the executable. Either way you're safe.

For those that _do_ require [such use cases][1] though; they can now do so without needing to expose their system to an unsandboxed native app.

[1]: https://wicg.github.io/webusb/#motivating-applications

[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Sir_Cmpwn on Friday March 02, 2018 @03:16PM (#16505287)
I know to do that. How about my grandma, who just clicks whatever button looks like it'll make the message go away sooner?

The web is a disaster and WebUSB is a prime piece of evidence supporting this.

[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Ajedi32 on Friday March 02, 2018 @03:35PM (#16505444)
Would that include the "Run" button on a downloaded executable?

While obviously we want to do as much as we can to discourage users from shooting themselves in the foot, there are limits. At some point, eventually you _do_ have to trust that the user knows what he's doing.

Giving users a choice on when to allow a page access to one specific USB device is not a "disaster".

[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by jperras on Friday March 02, 2018 @07:51PM (#16507095)
Just because you've never dreamed up a situation where it might be useful doesn't mean that they don't exist.
[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Sir_Cmpwn on Friday March 02, 2018 @08:37PM (#16507307)
Clarification: I've never wanted to do that in a web browser.
[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Spivak on Friday March 02, 2018 @03:05PM (#16505186)
Attaching a bootable USB drive to a HTML5 based KVM? Sure it could be accomplished in other ways buy why not this way?
[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Sir_Cmpwn on Friday March 02, 2018 @03:10PM (#16505236)
Why an HTML5 based KVM? A desktop app would be great for that!
[ Parent | on HN ]