How can I access to USB stick from website?

Question

I'm planning to make a login system by USB, so if you put in a USB-drive and open a specific webpage, the website asks the USB-drive for the code (e.g. by a JavaScript file, a redirect or something like that).

The problem is, because of sandboxing, you can't load or redirect to local files. I don't know a solution for this problem. Can you guys help me? I don't need specific code, just an example or something in that way.

Answer 1

Maybe you can read up on USB-HID. Wikipedia:

The USB human interface device class (USB HID class) is a part of the USB specification for computer peripherals: it specifies a device class (a type of computer hardware) for human interface devices such as keyboards, mice, game controllers and alphanumeric display devices.

Here are some references:

• USB HID (Human Interface Device)
• node-hid - Access USB HID devices from node.js
• DepthJS: 'Allows any web page to interact with the Microsoft Kinect using Javascript'.
• A related Stackoverflow question: Write data to USB HID using Javascript, HTML5, or any cross platform language (supports Android)

Answer 2

One other possibility is to check out the Chrome HID (Human Interface Device) APIs:

• Interacting with USB HID devices from web apps – via Chrome Apps, see below
• Relevant Chrome API docs

Please note that for the time being, you cannot interact directly with the USB device (i.e. you cannot access any WebAPI offering that kind of fine-grained control).

Building a Chrome App (different from a Chrome Extension) may help; This article may point you in the right direction, since it also provides sample code.

Answer 3

The only way I can think of is putting a html file on the usb stick that essentially generates some sort of login token and gives you a link or a form to a login processor. You can then access the webpage by opening the local file first which will redirect you to the actual webpage.

This local script may include a javascript from the server to get some challenge-response-data which it hashes somehow (perhaps in combination with a password) and puts it into the form data.