Two Google Developers Create API That Connects USB Devices to the Web

Google Developers Reilly Grant and Ken Rockot have published a draft document to the World Wide Web Consortium's Web Incubator Community Group (W3C WICG) detailing a newly created API (application program interface) for directly connecting USB devices to webpages. It is envisioned for use as a Web connectivity platform for hardware manufacturers.

The new API created by Google developers, dubbed WebUSB API, was published late last month and is still unofficial. The API is described as a "way to safely expose USB device services to the Web." The new API addresses all devices that can be connected to desktop system via USB port, from USB keyboards to IoT (Internet of Things) devices. The API is backward compatible, and is aimed to work with older USB devices.

"With this, API hardware manufacturers will have the ability to build cross-platform JavaScript SDKs for their devices. This will be good for the Web because, instead of waiting for a new kind of device to be popular enough for browsers to provide a specific API, new and innovative hardware can be built for the web from day one," explained Reilly Grant and Ken Rockot. The duo added, "WebUSB does not attempt to provide a general mechanism for any webpage to connect to any USB device."

The developers have also touched upon the security and privacy issues with their new WebUSB API and plan to build a system dubbed CORS or Cross-Origin Resource Sharing. The system "employed by browsers" will prevent page resources (such as fonts, JS scripts) from requesting data from other domains apart from the initiated one.

Grant and Rockot add that an attacker could write a malicious code that can use WebUSB API to access user's system for all available peripherals and their serial numbers leading any third-party to collect data. The CORS system for the new WebUSB API is aimed to "limit direct access to peripherals."

The developers have also confirmed that the WebUSB API is backward compatible which will mean that it will support old manufactured USB-capable devices to work without any additional firmware.

"For devices manufactured before this specification is adopted information about allowed origins and landing pages can also be provided out of band by being published in a public registry," they added. Developers can make suggestions at the WebUSB API GitHub repository.