Comment by Rohansi

> But what if what you have connected to your computer is a USB NFC card reader, and the user taps their FIDO authenticator on that?

So the user would need to: 1. Keep the malicious page open, or install a malicious extension 2. Grant access to the card reader from a list of USB devices 3. Then tap their card on that reader

IMO a bad actor is going to have more success getting people to run an executable they made the browser download. There's only so much you can do to protect people from themselves. Not everyone needs software to be locked down like a padded room.

> The problem with WebUSB is that it exposes devices that were built under the threat model that only trusted code would be able to access them to untrusted code.

Which platforms have USB devices locked down to "trusted code" only?