5 ms·

USB 3.1 now has digital signatures: may force you to use vendor chargers only

63 points by cnvogel 11y ago

hvidgaard 11y ago
At least in Europe they recently passed a law about charger reuseability. I'm sure companies will at least see some pushback, because a vendor charger only is exactly what they tried to stop.
- mihn 11y ago
  I hope so. It would be annoying to carry different chargers for all gear I carry.
  - viraptor 11y ago
    Even if it's implemented, charging from laptops, etc. is very unlikely to be removed. And that means there will be software-only solution to authenticate. Which means the right code will be dumped... Just give it time.
- isoos 11y ago
  I fear that this spec may be a way to circumvent the EU charger rules, e.g. the rules only specify the physical properties, but don't have a say whether the device may deny the charging. Bad business practice anyway, and I will probably use it only to cross out devices from the purchase lists.
  - hvidgaard 11y ago
    Maybe, but I hope that the law makers will see this as a the move it would be and rectify the bill such that all vendors are required to publish certificates for 3rd party use.
- baq 11y ago
  yeah, i've got wall sockets with usb ports (yay ikea) and if these stop working, i'll be seriously pissed.
guelo 11y ago
"People of the same trade seldom meet together but the conversation ends in a conspiracy against the public, or in some contrivance to raise prices." - Adam Smith
- nthcolumn 11y ago
  "Just because you're paranoid, don't mean they're not after you" - Nirvana
brongondwana 11y ago
Con: you'll have to use vendor chargers. Pro: you won't be able to use these: http://www.righto.com/2016/03/counterfeit-macbook-charger-teardown.html http://www.righto.com/2016/03/counterfeit-macbook-charger-te... or their moral equivalent http://www.righto.com/2012/03/inside-cheap-phone-charger-and-why-you.html http://www.righto.com/2012/03/inside-cheap-phone-charger-and... http://www.instructables.com/answers/240V-Power-Socket-with-USB-outlets-leaks-currentno/ http://www.instructables.com/answers/240V-Power-Socket-with-... http://www.gizmodo.com.au/2014/06/please-dont-buy-cheap-phone-chargers-and-cables/ http://www.gizmodo.com.au/2014/06/please-dont-buy-cheap-phon... ... it's not as simple as "big bad charger conspiracy" - scummy manufacturers really are putting out deathtraps out there, and a protocol protection to convince you not to keep using them makes sense.
- mihn 11y ago
  Dude its Universal Serial Bus for a reason and this just defies this reason.
  - masklinn 11y ago
    That the underlying bus is universal does not mean all device pairs must work (that already isn't the case).
    - izacus 11y ago
      Yes it means exactly that. Otherwise it fails as a user friendly connecting standard.
      - masklinn 11y ago
        > Yes it means exactly that. No, it does not now, and it never has at any point in the past.
  - SixSigma 11y ago
    > Universal Serial Bus It's not Universal It's not Serial And it's not a Bus gg Intel
brongondwana 11y ago
Con: you'll have to use vendor chargers. Pro: you won't be able to use these: http://www.righto.com/2016/03/counterfeit-macbook-charger-teardown.html http://www.righto.com/2016/03/counterfeit-macbook-charger-te... or their moral equivalent http://www.righto.com/2012/03/inside-cheap-phone-charger-and-why-you.html http://www.righto.com/2012/03/inside-cheap-phone-charger-and... http://www.instructables.com/answers/240V-Power-Socket-with-USB-outlets-leaks-currentno/ http://www.instructables.com/answers/240V-Power-Socket-with-... http://www.gizmodo.com.au/2014/06/please-dont-buy-cheap-phone-chargers-and-cables/ http://www.gizmodo.com.au/2014/06/please-dont-buy-cheap-phon... ... it's not as simple as "big bad charger conspiracy" - scummy manufacturers really are putting out deathtraps out there, and a protocol protection to convince you not to keep using them makes sense.
noja 11y ago
Bye bye USB!
- nthcolumn 11y ago
  Universal parallel bus! With cables that don't turn to wire straw after six months. (I just spent $50 renewing all the crappy cables for inexplicable multitude of screens we now apparently own.)
yread 11y ago
I don't think it's gonna be all that bad. It will be based on certificates so if you are able to control which certificates are accepted you can have pretty fine control.
- mtgx 11y ago
  That's kind of how I understood it. In their press release they talked about "compliance to the standard", which I don't think is the same with "smartphone vendor-only". And I think the user can modify this control somehow from the devices themselves. http://www.businesswire.com/news/home/20160412005983/en/USB-3.0-Promoter-Group-Defines-Authentication-Protocol http://www.businesswire.com/news/home/20160412005983/en/USB-...
ethana 11y ago
It's been fine up to USB 3.0, there were no major problem with electrical surges because they use fairly low voltage. It's USB3.1 power limit that's the problem. And it speaks more about the USB-IF's carelessness when drafting its specification for USB3.1 more than anything. They should've taken misuse of over voltage into consideration before releasing it to the manufacturers.
viraptor 11y ago
But... this was already possible. You could easily design a circuit+chip which will authenticate to your charger and only pass the current to the battery if it worked. A way to do it has been standardised, but it's not like some great barrier has been lifted.
- tristanj 11y ago
  Yeah this is exactly how I feel. This was already possible and it's not like companies aren't doing it. Apple is the most notable offender, every iPhone Lightning cable sold comes with a security chip; if the chip's not there, the phone won't charge. Normally this would be a problem for counterfeit cable sellers, but Chinese manufacturers have reverse engineered the chip hence customers don't notice a problem. http://www.cultofmac.com/246236/ios-7-killed-off-unlicensed-lightning-cables-but-heres-a-fix-that-might-work-for-you/ http://www.cultofmac.com/246236/ios-7-killed-off-unlicensed-...
gargravarr 11y ago
I don't think this is going to solve the problems of poor quality chargers. Recalling the Google engineer testing large numbers of USB3.0 cables, his Chromebook was damaged because a bad cable reversed the wiring of the power and data lines. Just because your phone asks the charger for its signature doesn't mean it won't get max continuous voltage to its DATA_RETURN channel instead. This is an unnecessary complication that isn't going to solve any problems, just add new ones.
vmateixeira 11y ago
What's the point of creating a standard if you're going to enforce vendor specific afterwards? Wasn't the standard on favor of less garbage after all? I mean, if all my gadgets would use the same connector, maybe vendors could start shipping products without a bundled one?
Angostura 11y ago
Why would that require you to use vendor chargers only? Surely it depends how the digital signature is used. At best, it simply gives you a way of authenticating that the device that you have just plugged into your USB port is actually what you think it is (huh? It's meant to be a memory stick, not a keyboard?!) before giving it system access.
makecheck 11y ago
A digital signature is reasonable if it can be used to produce a warning but not a denial. In other words, if my computer wants to pop up a “This will void your warranty!” warning the first time I plug in a cheap peripheral that has not been validated, I think that is fair use and buyers are free to continue and accept any consequences. On the other hand, I do not think the original manufacturer has the right to outright prevent the use of unsigned-but-standards-compliant devices, since that wanders into “you actually leased and never owned your device” territory.

63 points by cnvogel 11y ago

At least in Europe they recently passed a law about charger reuseability. I'm sure companies will at least see some pushback, because a vendor charger only is exactly what they tried to stop.

mihn 11y ago
I hope so. It would be annoying to carry different chargers for all gear I carry.
- viraptor 11y ago
  Even if it's implemented, charging from laptops, etc. is very unlikely to be removed. And that means there will be software-only solution to authenticate. Which means the right code will be dumped... Just give it time.
isoos 11y ago
I fear that this spec may be a way to circumvent the EU charger rules, e.g. the rules only specify the physical properties, but don't have a say whether the device may deny the charging. Bad business practice anyway, and I will probably use it only to cross out devices from the purchase lists.
- hvidgaard 11y ago
  Maybe, but I hope that the law makers will see this as a the move it would be and rectify the bill such that all vendors are required to publish certificates for 3rd party use.
baq 11y ago
yeah, i've got wall sockets with usb ports (yay ikea) and if these stop working, i'll be seriously pissed.

guelo 11y ago

"People of the same trade seldom meet together but the conversation ends in a conspiracy against the public, or in some contrivance to raise prices." - Adam Smith

nthcolumn 11y ago
"Just because you're paranoid, don't mean they're not after you" - Nirvana

brongondwana 11y ago

Con: you'll have to use vendor chargers. Pro: you won't be able to use these: http://www.righto.com/2016/03/counterfeit-macbook-charger-teardown.html http://www.righto.com/2016/03/counterfeit-macbook-charger-te... or their moral equivalent http://www.righto.com/2012/03/inside-cheap-phone-charger-and-why-you.html http://www.righto.com/2012/03/inside-cheap-phone-charger-and... http://www.instructables.com/answers/240V-Power-Socket-with-USB-outlets-leaks-currentno/ http://www.instructables.com/answers/240V-Power-Socket-with-... http://www.gizmodo.com.au/2014/06/please-dont-buy-cheap-phone-chargers-and-cables/ http://www.gizmodo.com.au/2014/06/please-dont-buy-cheap-phon... ... it's not as simple as "big bad charger conspiracy" - scummy manufacturers really are putting out deathtraps out there, and a protocol protection to convince you not to keep using them makes sense.

mihn 11y ago
Dude its Universal Serial Bus for a reason and this just defies this reason.
- masklinn 11y ago
  That the underlying bus is universal does not mean all device pairs must work (that already isn't the case).
  - izacus 11y ago
    Yes it means exactly that. Otherwise it fails as a user friendly connecting standard.
    - masklinn 11y ago
      > Yes it means exactly that. No, it does not now, and it never has at any point in the past.
- SixSigma 11y ago
  > Universal Serial Bus It's not Universal It's not Serial And it's not a Bus gg Intel

brongondwana 11y ago

noja 11y ago

Bye bye USB!

nthcolumn 11y ago
Universal parallel bus! With cables that don't turn to wire straw after six months. (I just spent $50 renewing all the crappy cables for inexplicable multitude of screens we now apparently own.)

yread 11y ago

I don't think it's gonna be all that bad. It will be based on certificates so if you are able to control which certificates are accepted you can have pretty fine control.

mtgx 11y ago
That's kind of how I understood it. In their press release they talked about "compliance to the standard", which I don't think is the same with "smartphone vendor-only". And I think the user can modify this control somehow from the devices themselves. http://www.businesswire.com/news/home/20160412005983/en/USB-3.0-Promoter-Group-Defines-Authentication-Protocol http://www.businesswire.com/news/home/20160412005983/en/USB-...

ethana 11y ago

It's been fine up to USB 3.0, there were no major problem with electrical surges because they use fairly low voltage. It's USB3.1 power limit that's the problem. And it speaks more about the USB-IF's carelessness when drafting its specification for USB3.1 more than anything. They should've taken misuse of over voltage into consideration before releasing it to the manufacturers.

viraptor 11y ago

But... this was already possible. You could easily design a circuit+chip which will authenticate to your charger and only pass the current to the battery if it worked. A way to do it has been standardised, but it's not like some great barrier has been lifted.

tristanj 11y ago
Yeah this is exactly how I feel. This was already possible and it's not like companies aren't doing it. Apple is the most notable offender, every iPhone Lightning cable sold comes with a security chip; if the chip's not there, the phone won't charge. Normally this would be a problem for counterfeit cable sellers, but Chinese manufacturers have reverse engineered the chip hence customers don't notice a problem. http://www.cultofmac.com/246236/ios-7-killed-off-unlicensed-lightning-cables-but-heres-a-fix-that-might-work-for-you/ http://www.cultofmac.com/246236/ios-7-killed-off-unlicensed-...

gargravarr 11y ago

I don't think this is going to solve the problems of poor quality chargers. Recalling the Google engineer testing large numbers of USB3.0 cables, his Chromebook was damaged because a bad cable reversed the wiring of the power and data lines. Just because your phone asks the charger for its signature doesn't mean it won't get max continuous voltage to its DATA_RETURN channel instead. This is an unnecessary complication that isn't going to solve any problems, just add new ones.

vmateixeira 11y ago

What's the point of creating a standard if you're going to enforce vendor specific afterwards? Wasn't the standard on favor of less garbage after all? I mean, if all my gadgets would use the same connector, maybe vendors could start shipping products without a bundled one?

Angostura 11y ago

Why would that require you to use vendor chargers only? Surely it depends how the digital signature is used. At best, it simply gives you a way of authenticating that the device that you have just plugged into your USB port is actually what you think it is (huh? It's meant to be a memory stick, not a keyboard?!) before giving it system access.

makecheck 11y ago

A digital signature is reasonable if it can be used to produce a warning but not a denial. In other words, if my computer wants to pop up a “This will void your warranty!” warning the first time I plug in a cheap peripheral that has not been validated, I think that is fair use and buyers are free to continue and accept any consequences. On the other hand, I do not think the original manufacturer has the right to outright prevent the use of unsigned-but-standards-compliant devices, since that wanders into “you actually leased and never owned your device” territory.