3 ms·

Jeez, I thought these auto opening usb things were isolated to Windows and only old versions. What’s the story with this on macOS?

makepanic 7y ago
It's a USB keyboard that opens types some commands to open a hard-coded website. You can't really prevent that.
- AdmiralAsshat 7y ago
  This is pretty much the way a Yubikey or other 2FA token works, no? The only difference being that it doesn't send the text until the sensor is covered.
  - paxswill 7y ago
    It's one way a Yubikey can work: Yubikey one time password (OTP). The more common (I think? Newer and standardized at least) way (U2F) accesses the key over some other method that doesn't have it act like a keyboard. There are other operation modes for Yubikeys, but personally I only use U2F and the CCID (aka act like a smartcard) modes.
- mikeash 7y ago
  You could require confirmation before accepting a new input device. This could be done with out of band signaling (such as a button on the computer itself that you push to say “yes, I want to use this keyboard”) or you could do it by requiring the user to type in a secret (such as their login password, or even just a PIN displayed on the screen) to enable it for other uses. I don’t know that people would accept this inconvenience, though.
  - deleted 7y ago
    [deleted]
  - dijit 7y ago
    > or you could do it by requiring the user to type in a secret how would you accomplish this given that the normal situation is that you're plugging in a keyboard?
    - codezero 7y ago
      I think the implication is you can type on the plugged in keyboard, but the OS won't pass the input through unless the first thing typed is a secret. This is somewhat similar to how bluetooth keyboards are enabled on macOS (or were the last time I connected one).
      - mikeash 7y ago
        Precisely. You get some authorization box and your input only goes to that box. If you authorize, it then acts like a normal keyboard.
OJFord 7y ago
The problem is.. it's a feature. All kinds of legitimate (well, this is legitimate too really, it's just weird) devices have similar behaviour, and in their cases it's what the user expects and wants.
RazZziel 7y ago
On all new and old versions of all major operative systems out there you'll be able to plug in any standard USB keyboard, and it'll start working automatically. That's exactly what's happening there, but the "keyboard" is pre-programmed to enter keys presses automatically in a way that makes a website pop up.
- codezero 7y ago
  Of course. That makes total sense.

makepanic 7y ago

It's a USB keyboard that opens types some commands to open a hard-coded website. You can't really prevent that.

AdmiralAsshat 7y ago
This is pretty much the way a Yubikey or other 2FA token works, no? The only difference being that it doesn't send the text until the sensor is covered.
- paxswill 7y ago
  It's one way a Yubikey can work: Yubikey one time password (OTP). The more common (I think? Newer and standardized at least) way (U2F) accesses the key over some other method that doesn't have it act like a keyboard. There are other operation modes for Yubikeys, but personally I only use U2F and the CCID (aka act like a smartcard) modes.
mikeash 7y ago
You could require confirmation before accepting a new input device. This could be done with out of band signaling (such as a button on the computer itself that you push to say “yes, I want to use this keyboard”) or you could do it by requiring the user to type in a secret (such as their login password, or even just a PIN displayed on the screen) to enable it for other uses. I don’t know that people would accept this inconvenience, though.
- deleted 7y ago
  [deleted]
- dijit 7y ago
  > or you could do it by requiring the user to type in a secret how would you accomplish this given that the normal situation is that you're plugging in a keyboard?
  - codezero 7y ago
    I think the implication is you can type on the plugged in keyboard, but the OS won't pass the input through unless the first thing typed is a secret. This is somewhat similar to how bluetooth keyboards are enabled on macOS (or were the last time I connected one).
    - mikeash 7y ago
      Precisely. You get some authorization box and your input only goes to that box. If you authorize, it then acts like a normal keyboard.

OJFord 7y ago

The problem is.. it's a feature. All kinds of legitimate (well, this is legitimate too really, it's just weird) devices have similar behaviour, and in their cases it's what the user expects and wants.

RazZziel 7y ago

On all new and old versions of all major operative systems out there you'll be able to plug in any standard USB keyboard, and it'll start working automatically. That's exactly what's happening there, but the "keyboard" is pre-programmed to enter keys presses automatically in a way that makes a website pop up.

codezero 7y ago
Of course. That makes total sense.