Using Bluetooth from WebExtension #612
Description
Are there any plans to make WebBluetooth usable from a browser add-on? (I'm not enough of a web developer to know if this is "automatic" or needs additional specification work…)
Speaking as someone currently building a BLE device, I have to agree with Mozilla's position that WebBluetooth is too much of a security and privacy risk to roll out. In particular, I don't have enough hubris to believe my webpage won't ever have XSS issues (thus yielding BT control over my device to malicious 3rd parties), and neither do I really want a low barrier to other websites talking to my devices.
From a user perspective, much of the same applies, I wouldn't ever feel comfortable granting BT permissions to any website. I also believe this pattern to be harmful to less technically inclined people — granting permissions to a website is a much lower psychological bar of trust than installing an application. I've seen "number of clicks" argued in other issues. 2 clicks in a browser are not the same as 2 clicks in an app store (or even the browser's extension manager.)
As such, I'd rather create a browser extension to support my devices; the extension can then control and expose a limited interface to some websites. This also has the advantage of having a review and update process, and allows (if properly designed) moving blocklist from browser updates to the extension "store". It's quite simply a useful additional layer of security (and privacy.)
Any comments? Was this previously discussed anywhere? (Didn't find anything…)