5 ms·

Just think of the security nightmare of plugging your computer into hardware on a data bus like USB. And that is not even taking into consideration that using a

by satysin 10y ago

Just think of the security nightmare of plugging your computer into hardware on a data bus like USB. And that is not even taking into consideration that using a publicly available screen and keyboard which on their own can easily be used for logging screen and key data.

solnyshok 10y ago
it could be wireless display and wireless keyboard, mouse
- satysin 10y ago
  That does not prevent the display/keyboard from capturing everything you look at or everything you enter though. Using untrusted I/O devices, wireless or wired, is a privacy and security risk.
  - lmkg 10y ago
    Just to build on this: I heard tell of a USB hard drive, back in the day, that would install its driver when plugged in. It did this by claiming to the attached device that it was a keyboard instead of a hard drive, and then sending keystroke data imitating opening a command prompt with hotkeys and typing in the installation commands. It's not difficult to imagine what "the bad guys" could have done instead (as if that wasn't bad enough). An I/O device is inherently a security risk because it sits in-between the user and the system, and effectively acts the intermediary between the two. That's a ton of trust. This isn't a completely unsolvable problem. One could imagine a security system where an app using external I/O is opt-in, and even then given restricted access (e.g. not in the Settings area). But it's something that has to be created and put in place first, and there will probably be some associated user friction.
tdb7893 10y ago
I think you would need to be careful to not put sensitive information into those terminals but that's not too hard to avoid in general. Generally I'm not doing anything that sensitive on my computer and with how my computer is configured I almost never have to actually type passwords.
- nkrisc 10y ago
  Except for most people (the kind who don't read Hacker News) their phone is their primary computing device and likely the only one they own. There already is loads of sensitive data on these peoples' devices. The only difference is they aren't yet plugging it into random hardware.
  - tdb7893 10y ago
    I doubt you would give it access to arbitrary memory so to actually get the data they would need an exploit of the USB connections and while it increases the attack surface I don't think it increases it unreasonably. The larger concern to me would be someone could be capturing the keyboard and monitor you connect to and could get most of your information through that.
    - eropple 10y ago
      USB3 alternate modes happily allow DMA with host devices. If the device supports Thunderbolt as an alternate mode, that gets...tricky. And given that it's pretty likely that this posited setup would encourage the use of external graphics processing hardware...red flags, Batman.

by satysin 10y ago

solnyshok 10y ago

it could be wireless display and wireless keyboard, mouse

satysin 10y ago
That does not prevent the display/keyboard from capturing everything you look at or everything you enter though. Using untrusted I/O devices, wireless or wired, is a privacy and security risk.
- lmkg 10y ago
  Just to build on this: I heard tell of a USB hard drive, back in the day, that would install its driver when plugged in. It did this by claiming to the attached device that it was a keyboard instead of a hard drive, and then sending keystroke data imitating opening a command prompt with hotkeys and typing in the installation commands. It's not difficult to imagine what "the bad guys" could have done instead (as if that wasn't bad enough). An I/O device is inherently a security risk because it sits in-between the user and the system, and effectively acts the intermediary between the two. That's a ton of trust. This isn't a completely unsolvable problem. One could imagine a security system where an app using external I/O is opt-in, and even then given restricted access (e.g. not in the Settings area). But it's something that has to be created and put in place first, and there will probably be some associated user friction.

tdb7893 10y ago

I think you would need to be careful to not put sensitive information into those terminals but that's not too hard to avoid in general. Generally I'm not doing anything that sensitive on my computer and with how my computer is configured I almost never have to actually type passwords.

nkrisc 10y ago
Except for most people (the kind who don't read Hacker News) their phone is their primary computing device and likely the only one they own. There already is loads of sensitive data on these peoples' devices. The only difference is they aren't yet plugging it into random hardware.
- tdb7893 10y ago
  I doubt you would give it access to arbitrary memory so to actually get the data they would need an exploit of the USB connections and while it increases the attack surface I don't think it increases it unreasonably. The larger concern to me would be someone could be capturing the keyboard and monitor you connect to and could get most of your information through that.
  - eropple 10y ago
    USB3 alternate modes happily allow DMA with host devices. If the device supports Thunderbolt as an alternate mode, that gets...tricky. And given that it's pretty likely that this posited setup would encourage the use of external graphics processing hardware...red flags, Batman.