TinyUSB Finally Gets WebUSB Support

Back in May of this year, Adafruit released the TinyUSB stack for the Arduino IDE, which supports SAM D21, SAM D51, nRF52840, and STM324F-based development boards, such as Adafuit’s Feather M4 Express. The TinyUSB library allows those boards to appear as a USB drive, letting users drag-and-drop files directly to the board, much in the same fashion as a flash drive. Configuration files, images, audio, fonts, etc., can all be imported through a few clicks of a mouse. What’s more, the TinyUSB library can be implemented to take advantage of SPI Flash, SD cards, and internal chip memory as storage options as well.

The release of WebUSB provides users with access to those storage options securely over the internet using compatible browsers. Adafruit explains:

“Following up on our earlier mass-storage support announcement for TinyUSB, we just added WebUSB support! You can now send and receive data over Chrome (or other WebUSB) browsers with Javascript or whatever else is your favorite web programming language.”

At its core, WebUSB is a JavaScript API and was published by the Web Platform Incubator Security Group. Chrome version 61 enabled WebUSB by default back in 2017, but was subsequently disabled due to phishing concerns, as the API made it possible to bypass authentication devices. Attackers could use WebUSB and an accompanying website to convince people to type in their user names and passwords to unlock accounts.

It’s unknown if Google has patched this security flaw for their Chrome browser in the latest revisions. That being said, Adafruit has uploaded WebUSB example code, and webpage code for the TinyUSB to their GitHub repository for those interested.