Conversation

so, a lot of people I know have a severely negative view of WebUSB. that view is, mostly, justified. I think it is only more interesting then that I see the GrapheneOS flashing tool--yes, flashing stuff via the browser--as net beneficial

Quote Tweet

GrapheneOS

@GrapheneOS

Jan 24, 2021

An experimental version of our web-based installer for GrapheneOS is now available: grapheneos.org/install/web This can be used from browsers with WebUSB support. Most Chromium-based browsers are supported including Chrome, Edge and Brave. No need to run any additional software.

Show this thread

144

Catherine

@whitequark

Jan 24, 2021

it's beneficial because flashing is hard and most people rightfully don't want learn how fastboot, adb, etc work, and seek out convenience. they'll find it either with the first party, GrapheneOS, or a potentially malicious or negligent third party. here, WebUSB is harm reduction

Catherine

@whitequark

Jan 24, 2021

I'm not sure if WebUSB could have been designed in a way that makes harm negligible. I know that it could have been designed to minimize potential harm, and it clearly wasn't (Chrome just lets you do ~anything to ~any device), and I find that unfortunate.

Replying to

Chrome has a long history of adding API's with vast attack surfaces. Remember NaCl?

Replying to

and

As far as I know, WebUSB originated at Mozilla, as did WebGL to a lesser extent. They don't implement WebUSB in Firefox, but it was their idea, and their initial work on the spec. NaCl evolved to PNaCl and then that effort got directed into the collaborative WebAssembly work.

7:23 PM · Jan 24, 2021Twitter Web App

Replying to

and

Mozilla lost interest in the features like WebUSB when FirefoxOS died. It might not be enabled by default in Firefox, but I expect you could turn it on via an about:config toggle if FirefoxOS still existed. ChromeOS exists of course, although it has a whole Android userspace now.

Replying to

and

WebGL is scarier to me than WebUSB. WebGL is enabled by default and has drastically more attack surface than any device that I'm ever likely to let a site access via WebUSB. Distinction is that WebGL is *supposed* to be safe while a USB device can deliberately do dangerous stuff.