Google, Mozilla Working on Letting Web Apps Edit Files Despite Warning That it Could Be Abused (techrepublic.com)

Google and Mozilla are heading a group that is devising a way for users to save changes they make using web apps. From a report: The idea is to allow users to save changes they've made using web apps, without the hassle of having to download new files after each edit, as is necessary today. "Today, if a user wants to edit a local file in a web app, the web app needs to ask the user to open the file," said Google developer advocate Pete LePage. "Then, after editing the file, the only way to save changes is by downloading the file to the Downloads folder, or having to replace the original file by navigating the directory structure to find the original folder and file. This user experience leaves a lot to be desired, and makes it hard to build web apps that access user files."

To this end, the W3C Web Incubator Community Group (WICG), which is chaired by representatives from Chrome developer Google and Firefox developer Mozilla, is working on developing the new Writable Files API, which would allow web apps running in the browser to open a file, edit it, and save the changes back to the same file. However, the group says the biggest challenge will be guarding against malicious sites seeking to abuse persistent access to files on a user's system. "By far the hardest part for this API is of course going to be the security model to use," warns the WICG's explainer page for the API. "The API provides a lot of scary power to websites that could be abused in many terrible ways."

Comments

Re:ActiveX, anyone?

[nazsco]

You forget one thing: Google!

Google is microsoft plus advertising.

When IE was pushing internet specs over W3c, it had nothing but the OS carrot pulling in users. If the website didn't like IE, it could just ask the user to change browsers, and the user did.

Now we have Google, who controls both the users via chrome (and access to their own products, just like microsoft --try to use hangouts, which is required for interviews etc, without chrome!) but besides that, it also controls the websites via their Ad business.

Now you have someone who have a monopoly on both user and site choices. Pushing one webstandard after another over everyone's heads. E.g. http2, http3... which is actually UDP...

Here how it is going down: they will convince all the good engineers that could block this abusive idea that the feature will have lots of UI alerts. The first use case will be something like photoshopOnline. Then, when those smart people are not looking, they will make every site request the permission because they will use it for data persistence on their analytics code! then they will make this the default on chrome, because users complain about too many popups! then they will move this to data persistence for adWords et al. And at this point it is end game trying to not be tracked among devices and accounts on google ecosystem.

Give Me an Opt-Out or I'm Switching Browsers

[Anonymous Coward]

I don't feel this is secure and don't need it. If Mozilla implements this API in Firefox and doesn't allow me to opt-out of it and restrict it, I'll find a new web browser. It's not acceptable from a risk-reward perspective for someone who doesn't use web apps to edit files on one's hard drive.

Really, I think this should be blocked on an operating system level if possible, at least showing a dialogue box warning you when a website in your browser is trying to do this and giving the option to accept one-time only, decline one time only, or set to allows allow or always deny. If Windows 10 is going to keep being updates incessantly with questionable features and higher bug counts, they can at least give us this, or the browsers themselves don't.

It might be a good idea to ask some of the smaller browsers like Waterfox, Vivaldi, Pale Moon, and Basilik whether or not they are going to adopt this. Maybe one or more of them will make a good fallback if the more mainstream browsers and big operating system don't want to protect their users.

I kind of get when Google Chrome is doing this- Google wants everything done on the Internet because that's where their ads are and that's where they can get data on your to use to target you ads, and they will ignore obvious significant security concerns to achieve that. Why Mozilla would play follow the leader on this, I'm not sure. I guess they don't want to be perceived as lacking a feature the market leading browser has. However, this isn't a feature, it's a bug (See what I did there? :) ).