Reconsider restricting access to HID devices using WebUSB API

[FluorescentHallucinogen]

Recently I bought an E1DA 9038D DAC for my smartphone.

This device comes with a paid proprietary Android app to tweak (configure) it.

And I decided to reverse engineer this app and create a free open source PWA using WebHID API.

All is ok on my desktop. I wrote a small PoC using WebHID API and it works!

let devices = await navigator.hid.requestDevice({filters:[]});

let device = devices[0];

await device.open();

if (device.opened) {
  console.log("Device is open.");
}

device.oninputreport = (event) => {
  console.log('Received input report with ID ' + event.reportId + ' from ' + event.device.productName);
  console.log(new Uint8Array(event.data.buffer));
};

// Get volume
await device.sendReport(0, new Uint8Array([7, 0, 0]));

// Set volume
await device.sendReport(0, new Uint8Array([6, 0, 2, 128, 64]));

// Factory reset
await device.sendReport(0, new Uint8Array([9, 0, 0]));

But when I tried it on Android I found that WebHID API is not supported on Android currently. :(

@nondebug BTW, any ETA when WebHID API will be supported in Chrome on Android?

So I decided to rewrite my code from WebHID API to WebUSB API, because WebUSB API supported on both, desktop and Android.

But I faced the following problem:

I've googled a little and found this: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/LZXocaeCwDw

It seems it's no longer possible to control HID devices using WebUSB API.

The main feature of my PWA (cross-platform) has been lost. :(

@reillyeon I'm stuck. What to do? What about removing this restriction in Chrome on Android, while WebHID API is not supported on Android? Or what about adding this device to the whitelist?

I've tried to not claim the interface, but then I get a The specified interface has not been claimed. error.

[beaufortfrancois]

@nondebug and @reillyeon will have more to say but in the mean time, you may want to star https://bugs.chromium.org/p/chromium/issues/detail?id=964441 to keep track of WebHID support for Android.

[reillyeon]

In order to support communicating with these kinds of devices on Android while preserving the same security guarantees as WebUSB and WebHID have on other platforms we need to implement checks that prevent accessing the HID usages which are normally blocked by WebHID. This is complicated by Android not having an equivalent to the HID APIs which are used to implement WebHID on other platforms. The way native Android applications connect to a USB HID device is using the USB host API (the same one WebUSB uses) and detaching the USB HID driver (which WebUSB doesn't allow). One way to implement WebHID on Android would be to use this API however this wouldn't permit sharing the HID device with other applications the way WebHID does on other platforms because the browser would have to take full control over the USB HID interface.