4 ms·
>It's 2019. Why the f* haven't Windows, MacOS and Linux all implemented these basic precautions? Because up until 10 years ago, developing your own USB device
by q3k 8y ago
>It's 2019. Why the f* haven't Windows, MacOS and Linux all implemented these basic precautions?
Because up until 10 years ago, developing your own USB device was generally expensive and malicious devices ended up being out of scope in threat modelling. In addition, some models these days still define 'physical access == game over'...
- robertAngst 8y ago>USB device was generally expensive How expensive? USB is a protocol, a micro, and some power management. How long ago was this 'out of scope'?
- jolmg 8y agoI imagine he means before the advent of 3d printing, services like PCBWay, products like Arduino, and online stores like DigiKey. It's probably much easier to make one's own devices today than it was when USB was first being designed. He's also right about the physical access thing. Fundamentally, it doesn't make much sense to add protections against scenarios where the attacker apparently needs physical access, because there's no way to protect against all things he could possibly do then. It's not really obvious that the user needs protecting from himself as he plugs in a device of doubtful origins. We used to hold the user to higher standards.