That's generally how this works. The part that really annoys me is that they don't set uaccess on stuff like a serial device, fastboot / adb, hardware wallet, etc. The rules cover common cases but packages have to ship their own rules dealing with every USB device case-by-case.
Conversation
There are people involved in this kind of decision making with no actual threat model or rational thinking about security paired with an anti-user attitude. If I can smash the device with a hammer or plug it into something else, just let me use it. It's not just USB either.
1
1
I at least claim to not be afflicted by either. permission dialogs are a barrier for our users! I want our devices to be usable! but I'm concerned about the "how could this possibly go wrong" approach as applied to a class of devices with historically less than zero security...
1
1
... I'm concerned about a kernel side interface that's not been treated with enough care, and I'm concerned that use cases where the physically logged in user does not own the machine are getting lost
maybe all of these are worth smashing? if so, let's call that out as a goal
2
1
but the fact that the WebUSB folks immediately yolo'd themselves into breaking the FIDO security model does not speak well of the amount of prior planning that's been put into changing the longstanding assumptions about what can access USB devices
ref:
1
1
It's already broken for a compromised device. When I use FIDO login with my Trezor Model T, it shows me the site identity on the touchscreen and I have to allow it there. The security key design is already broken if it relies on the OS / browser not being compromised.
3
historically users are really really bad at comparing things on two different screens
IMO the FIDO model is broken in all sorts of ways, so this might just be an artifact of that
1
1
In general, I don't think an HSM without secure input and output can actually provide as much as people expect from them.
For example, a hardware wallet for Bitcoin with no display lets an attacker send a million dollars to themselves when you confirm buying a pizza with it.
2
1
1
So, a proper hardware wallet has a screen and secure input. Ideally, it has a touchscreen or physical keyboard rather than just a few buttons.
HSM design in the Bitcoin world is so much more advanced in terms of the workflow and threat model of a traditional HSM. Find it weird.
2
1
nothing like a concrete financial incentive? there are other aspects of b*tc**n hardware wallets that I find... underdesigned though, e.g. the trezor folks yolo'd their side channel mitigations instead of just using a Montgomery ladder for mysterious reasons
1
1
Trezor doesn't have good physical security in general because they won't sign and NDA and use closed source firmware for a secure element. They're working on their own open source secure element: tropicsquare.com.
they could still do much, _much_ better in firmware. at the risk of shameless self promotion,
1