Conversation

so, a lot of people I know have a severely negative view of WebUSB. that view is, mostly, justified. I think it is only more interesting then that I see the GrapheneOS flashing tool--yes, flashing stuff via the browser--as net beneficial

Quote Tweet

GrapheneOS

@GrapheneOS

Jan 24, 2021

An experimental version of our web-based installer for GrapheneOS is now available: grapheneos.org/install/web This can be used from browsers with WebUSB support. Most Chromium-based browsers are supported including Chrome, Edge and Brave. No need to run any additional software.

Show this thread

144

Catherine

@whitequark

Jan 24, 2021

it's beneficial because flashing is hard and most people rightfully don't want learn how fastboot, adb, etc work, and seek out convenience. they'll find it either with the first party, GrapheneOS, or a potentially malicious or negligent third party. here, WebUSB is harm reduction

Catherine

@whitequark

Jan 24, 2021

I'm not sure if WebUSB could have been designed in a way that makes harm negligible. I know that it could have been designed to minimize potential harm, and it clearly wasn't (Chrome just lets you do ~anything to ~any device), and I find that unfortunate.

Replying to

If I remember correctly, There was originally supposed to be a marker value in usb descriptors to say whether a device was fit for webusb. That got tossed out early.

Replying to

and

I don't think there's much point in that. The issue isn't really that granting access to devices can be harmful but that there's no explanation of what access provides. Granting access to fastboot after enabling OEM unlocking can clearly be used maliciously, but it's very useful.

Replying to

and

(I think there needs to be some sort of request whitelist, because without one you'll be able to flip all sorts of random junk built on popular ICs into DFU mode and wreak havoc.)

Replying to

and

The counterargument would be that right now, users are told to download a driver and run it as Administrator, giving it access to not just the device - but literally everything forever. With WebUSB, access can be limited to a device you choose. I think it's great 🤷‍♂️

Replying to

something really does rub me the wrong way about "simple"-seeming Danger Buttons like the single, boring-seeming prompt in Android that grants *raw APDU-level access to your phone's SIM* to a paired Bluetooth device

Replying to

Sure, we need security UX experts to make sure it's being adequately communicated. The answer isn't "Just make them install an EXE, then it's not our problem"!

Replying to

The first step to understanding whether the UX is correct is to survey the current non-malicious uses of WebUSB and understand whether to support each use case, whether a different API should be exposed for it instead, and whether users can navigate the UI to stop harmful uses.

Replying to

So, what about this use case? twitter.com/GrapheneOS/sta In theory, the browser could have a fastboot API and could explicitly hard-wire a list of devices with a proper OEM unlocking toggle, user confirmation for `fastboot unlock` and verified boot. Can't really see it happening.

Quote Tweet

GrapheneOS

@GrapheneOS

Jan 24, 2021

Show this thread

6:22 PM · Jan 24, 2021Twitter Web App

Replying to

Updating firmware on other kinds of USB devices seems like a legitimate use case. It would be pretty cool if I could go the Logitech website and update the firmware for my mouse on an arbitrary OS rather than installing their software on Windows. What if I don't have Windows?

Replying to

What if I don't want to install / run Logitech's sketchy software on my Windows installation? By the way, I really don't want to do that. That means I don't update the firmware on my wireless mouse. That seems like a bad thing. I would assume there are security updates for it.

Show replies