WebUSB API

[Jxck]

Request for Mozilla Position on an Emerging Web Specification

• Specification Title: WebUSB API
• Specification or proposal URL: https://wicg.github.io/webusb/
• Caniuse.com URL (optional): https://caniuse.com/#feat=webusb

Other information

• WebKit Not Considering: https://webkit.org/status/#feature-webusb
• TAG Review: WebUSB w3ctag/design-reviews#108

[AntoineTurmel]

For reference, WebUSB was being developed at the time for FirefoxOS, see bug: https://bugzilla.mozilla.org/show_bug.cgi?id=674718

[dbaron]

Some comments from elsewhere include #95 (comment), w3ctag/design-reviews#108, the minutes from Thursday 2016 July 28 TAG meeting. Major concerns raised there include:

• security issues related to attacks on devices that, once compromised, could be used to attack the user's computer more generally
• the permissions model (whether a question can be posed to the user that yields informed consent, whether there should be a CORS-like model for devices to say that they want to interact with particular domains which may improve security but hurts openness)

[karelbilek]

It would be interesting for me to know this status too

[ekr]

I believe we should mark this "harmful". @martinthomson

[dbaron]

I have a PR in #193 to do that that ended up gathering a bunch of discussion on the rationale we should state (discussion that should probably have happened here instead). I need to figure out how to revise that...

[annevk]

Closing as that PR was merged.

[marcoscaceres]

From a discussion elsewhere, Chrome allows flashing Android phones via WebUSB:
https://www.androidauthority.com/android-flash-tool-1078391/

[marcoscaceres]

Another example that came up on twitter was a custom USB driver for a thermal printer:
https://twitter.com/samccone/status/1280709905595285505?s=20

(Sorry for the noise, just collecting "as seen in the wild" use cases as people bring them to my attention on twitter)

[karelbilek]

Trezor (a cryptocurrency Hardware wallet) - my former employer - uses WebUSB, when available, for communication with web wallet, if used from a browser. (I wrote the WebUSB code into both the website and the C firmware.)

I think in the next, planned version, they offer Electron app first, which does not use WebUSB, but includes local server in go and c++ (because it's still easier for debugging to use the raw OS calls), but if you decide to skip Electron app and use web, it goes to WebUSB.

one reason why they plan to push Electron instead of web app is that Firefox doesn't support WebUSB :)

[marcoscaceres]

Appreciate the input @karel-3d, thank you.

[wisniewskit]

For reference, WebADB is now using WebUSB and its lack of support for non-Chrome browsers was just reported on webcompat.com.