Linux USB Gadget Driver Being Extended For WebUSB

[phoronix]

Phoronix: Linux USB Gadget Driver Being Extended For WebUSB

The Linux USB gadget kernel driver saw a patch published today for exposing of a device's landing page as part of the WebUSB specification. WebUSB as a reminder is the industry standard for providing a JavaScript API to securely access USB devices from web pages and is already supported by the likes of Google Chrome and Microsoft Edge...

https://www.phoronix.com/news/Linux-USB-Gadget-Driver-WebUSB

[awesz]

Pro tip: if it starts with "Web", it's bad.

[marccollin]

could be interesting if garmin gps use this techno...

[archsway]

I remember trying to patch the kernel to emit the descriptors for this, but the OTG port on the device I was using only supported USB 2.0 and not USB 2.1, so it didn't work. (I tried changing the USB version in the OTG driver but the hardware seemed to not like that).

In general, WebUSB is annoying to work with because things differ between platforms... functions that do one thing on a Linux system do something else on Windows or even just fail. Getting Windows to recognise the device at all can be a challenge. Debugging is also quite hard, at least on Windows.

[archkde]

Pro tip: if it starts with "Web", it's bad.

Pro tip: If someone tells you they "know" something is bad (or good, for that matter) by only looking at the name, they probably have no idea what it even is.

[BaumKuchen]

JavaScript API to securely access USB devices from web pages

This sounds very wrong and the word "securely" sticks out like a thorn.

[Ananace]

This sounds very wrong and the word "securely" sticks out like a thorn.

Well, it's probably maybe more secure than simply letting the web page send arbitrary USB commands.

I don't think I'd personally be very interested in the WebUSB part of WebUSB, but having USB devices officially provide (admittedly JavaScript) APIs for communicating with them sounds like it could be really interesting, should make building open-source control software and other such things a lot easier for proprietary pieces of hardware.

[caligula]

Ok so this gadget support means the web page can pretend it's a client device?

[cynic]

so, any website could "securely" access my USB devices, just like my keyboard for example? and store all my keystrokes?
how long before some bad actor find a way to trick the user to click the authorization button to steal his home banking credentials?

I definitely don't like the idea that the web is the "new OS": this requires way too much trust in what random people can do with my harware.

[Volker Schmidt]

Allowing arbitrary unchecked code, access to my USB Hardware introduces a completely new attack vector. What could possibly go wrong, when a web service can access my USB drive directly. I am sure there is a first layer of protection, but how many times have we heard about the unpenetrable sand box, only to find out it had holes after all.