Comments (9)
I agreed. CCCD shall not be modified. But another application can access CCCD of other application's private BluetoothGattDescriptor?
from web-bluetooth.
Do you mean the private BluetoothGattDescriptor which represents the per-client instance of the CCCD that the peripheral keeps for that specific application? If I understand you correctly, then given a UA acting as the central, all applications running locally would have to share the same CCCD, so different apps won't have private GATT descriptors.
Though correct me if you meant something else.
from web-bluetooth.
+1 for blocking access to certain services, characteristics, and descriptors. Plausible ones include:
Device identification (don't allow reading):
- service.device_information
- characteristic.serial_number_string
- characteristic.system_id
Messing with connections:
- characteristic.gap.reconnection_address
- characteristic.gap.peripheral_privacy_flag
- descriptor.gatt.client_characteristic_configuration
- descriptor.gatt.server_characteristic_configuration
- characteristic.gatt.service_changed (can't stop indications)
Other:
- characteristic.gap.device_name (don't allow writing?)
I'm happy to take a pull request for this. It probably makes sense to update the rationale document to match.
from web-bluetooth.
That was another point that I was going to bring up: the GAP and GATT GATT services (that is GATT services with 0x1800 and 0x1801) shouldn't ever be accessed by the application. I think this brings out the question of how we would want to implement blacklisting in general:
- Hide services, individual characteristic & descriptors entirely from the API so they cannot be discovered, read, or written to by applications.
- Make everything accessible BUT restrict value write access.
I'm generally in favor of 2. I think we should always allow reading the values in general. I would even go so far as to allow reading the values from the device information service but I guess this needs some discussion.
I'd be happy to take shot at updating the spec and the rationale doc and we can discuss/review in the pull request.
from web-bluetooth.
Just quick reaction (I'll read the thread in depth later on) ; don't we want to create a more generic issue and close this one?
from web-bluetooth.
We probably need to have an updatable list of blacklisted things, to handle new manufacturers that allocate UUIDs that have security problems if they're accessed from the web. I'm in the process of sending a New Work Proposal to the BT SIG to have them maintain a list like this, but until that winds its way through the process, @slightlyoff suggested we pick a quick-and-dirty location for the registry.
How about a new git repository named something like https://github.com/WebBluetoothCG/registries with a text file in it for each blacklist? We can hand that list over to a more official place whenever we pick the right official place.
from web-bluetooth.
I don't know that it's fair to say "the GAP and GATT GATT services (that is GATT services with 0x1800 and 0x1801) shouldn't ever be accessed by the application. "...
I run a citizen-science CO2 tracking app that's used as a volunteer part of the coronavirus response, and I'd like to be able to read the aranet4 serial number over bluetooth. Users have an awful lot of trouble entering it correctly as is, and this would also help automated data collection.
In that light, I also don't think it's compatible with the idea that "Blocklisting UUIDs used on only vulnerable devices is preferred". Does that make sense?
from web-bluetooth.
Hmm. I'm seeing another issue that makes the serial # blacklisting more of a problem.
Basically, I'd like to tie a specific device-via-bluetooth to a specific instance of that device in my database. If users only have a single aranet4, this can work ok. But if they have multiple, how do I know programmatically which bluetooth device they've connected to? As their calibrations may be drifting differently (they probably will), this is a data-integrity problem.
I just went ahead and looked into the id
BluetoothDevice
field, and I'm seeing that the way that it's implemented in google chrome is not at all repeatable. It's generated at runtime with a crypto::RandBytes(bytes);
call! This is not repeatable or reliable. So how else can I make use of WebBluetooth?
Honestly, it's looking more and more like I'll be spinning up a react native app.
from web-bluetooth.
from web-bluetooth.
Related Issues (20)
- Access device MAC address HOT 4
- About navigator.bluetooth.requestLEScan() function HOT 3
- Blue
- Is client to client communication (between nearby devices) possible? HOT 2
- No iBeacon data from WatchAdvertisements() HOT 4
- requestLEscan not working HOT 1
- watchAdvertisements() should return a "sentinel" object HOT 4
- How to invalidate characteristics cache given that Service Changed is not implemented yet? HOT 2
- "current settings object's relevant global object" is not defined HOT 4
- Bookmarks crashing HOT 1
- No need for a [[BackingMap]] in Bluetooth{Manufacturer,Service}DataMap anymore
- BluetoothAdvertisingEventInit.{manufacturer,service}Data's type is unclear HOT 1
- Web Bluetooth Manufacturer Specific Data Map empty HOT 7
- requestDevice filters to exclude devices. HOT 1
- Would be nice to enable the Discussions on this repo, not everything is an issue HOT 1
- [watchAdvertisements] Support Extended Advertising HOT 8
- can't access services list on some devices HOT 2
- Kerem
- Services not found (Primary detected as Secondary?) HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from web-bluetooth.