5 ms·

"How is the regular guy supposed to figure out if a USB device is OK or not? I guess the easy answer is to say "Don't use an unknown device" but I don't think t

by rsync 8y ago

"How is the regular guy supposed to figure out if a USB device is OK or not? I guess the easy answer is to say "Don't use an unknown device" but I don't think this is practical especially in the case of a charger." I use a "USB Condom". My current USB Condom is this one: https://www.amazon.com/PortaPow-Data-Blocker-Adaptor-SmartCharge/dp/B00T0DW3F8/ https://www.amazon.com/PortaPow-Data-Blocker-Adaptor-SmartCh... In fact, I sometimes even use it with my own, trusted, devices. For instance, I don't want my macbook itunes to know about my iphone so when I charge from my own laptop, I use the "condom". I'm sure these exist for USB-C...

lostlogin 8y ago
And another dongle.
maxxxxx 8y ago
Makes me wonder why manufacturers don't have a USB permission scheme like they have for apps. It would be nice to give a USB device only certain permissions like charging.
- bigato 8y ago
  Because anything software is hackable by definition
- ksk 8y ago
  The USB device itself tells the machine what its "unique" identifier is. If you use it for permissions, then it could just lie.
- untog 8y ago
  Anything software based would still be vulnerable. The only surefire way is to disconnect the pins, as these USB condoms do.
  - astrodust 8y ago
    It must be hardware based. Like the USB bus can negotiate with your system and then upgrade the connection if the device passes. Of course this would require cryptography to do properly so it'll never, ever happen.
    - manicdee 8y ago
      USB still involves software, and the code that runs the USB interface is invisible to the host computer. You have no way to verify that the cable or USB condom is not hosting malicious code.
      - astrodust 8y ago
        I mean if the USB host device itself has specialized USB hardware that can lock the ports in power only until they're fully enabled by the OS, then you'd be in a better position. Either that or a tiny switch beside each port to enable/disable the neutering feature.
- robbiet480 8y ago
  iOS does as of iOS 12. You have to verify every USB data connection before data is shared.
seanp2k2 8y ago
AFAIK they don’t exist for USB-C PD since it’s quite a bit more complicated than previous protocols (switchable source / sink, variable voltage
magnetic 8y ago
How do you know you can trust the "USB Condom"?
darklajid 8y ago
Hey, I'm sorry to hijack this. Is there a way to contact you about rsync.net? Support hasn't replied for a week, Twitter seems unmonitored - don't know any other way but this right here.

by rsync 8y ago

lostlogin 8y ago

And another dongle.

maxxxxx 8y ago

Makes me wonder why manufacturers don't have a USB permission scheme like they have for apps. It would be nice to give a USB device only certain permissions like charging.

bigato 8y ago
Because anything software is hackable by definition
ksk 8y ago
The USB device itself tells the machine what its "unique" identifier is. If you use it for permissions, then it could just lie.
untog 8y ago
Anything software based would still be vulnerable. The only surefire way is to disconnect the pins, as these USB condoms do.
- astrodust 8y ago
  It must be hardware based. Like the USB bus can negotiate with your system and then upgrade the connection if the device passes. Of course this would require cryptography to do properly so it'll never, ever happen.
  - manicdee 8y ago
    USB still involves software, and the code that runs the USB interface is invisible to the host computer. You have no way to verify that the cable or USB condom is not hosting malicious code.
    - astrodust 8y ago
      I mean if the USB host device itself has specialized USB hardware that can lock the ports in power only until they're fully enabled by the OS, then you'd be in a better position. Either that or a tiny switch beside each port to enable/disable the neutering feature.
robbiet480 8y ago
iOS does as of iOS 12. You have to verify every USB data connection before data is shared.

seanp2k2 8y ago

AFAIK they don’t exist for USB-C PD since it’s quite a bit more complicated than previous protocols (switchable source / sink, variable voltage

magnetic 8y ago

How do you know you can trust the "USB Condom"?

darklajid 8y ago

Hey, I'm sorry to hijack this. Is there a way to contact you about rsync.net? Support hasn't replied for a week, Twitter seems unmonitored - don't know any other way but this right here.