8 ms·
Really need a setting “never trust any device ever”. I’ve never once had a use case with my phone to do anything but charge. Really hate when I plug in my phone
by paulsutter 7y ago
Really need a setting “never trust any device ever”. I’ve never once had a use case with my phone to do anything but charge. Really hate when I plug in my phone to charge in a car and the car takes over my UI. All bad ideas. If I want to move photos I use the network.
- judge2020 7y agoCar takes over the phone's UI? Is that an Android thing? I've only ever heard of carplay/android auto taking over the Car's UI (and replacing it with a much better UI).
- kemayo 7y agoIf we're speaking of an iPhone, if you plug one into a CarPlay receiver then it lightly interrupts the phone use. The iPhone gets a big CarPlay splash screen (which you can dismiss), and switching apps on the car display will also switch them on the phone. This is changing in the upcoming iOS 13, so the car display and the phone will be much more independent[1]. As someone who's often a passenger with their phone plugged in, I'm happy for this. [1]: https://www.macstories.net/stories/carplay-in-ios-13-a-big-leap-forward/ https://www.macstories.net/stories/carplay-in-ios-13-a-big-l...
- excalibur 7y agoMoving large amounts of data over the network can be cumbersome. MicroSD cards can come in pretty handy.
- gambiting 7y agoThis device shows up as a keyboard - should keyboards never be trusted ever? How would that work?
- throwaway5d097 7y agoFirst thought was whitelisting USB vendor and device IDs, but I guess those could be spoofed. A button above every USB port? Going back to PS/2 could be an option? Guess that wouldn't be too different from allowing all devices only on a single USB port.
- cevn 7y agoWhat if the USB device upon gaining power opened up and poked your button? : P
- dredmorbius 7y agoShannon's Ultimate Machine.... https://invidio.us/watch?v=cZ34RDn34Ws https://invidio.us/watch?v=cZ34RDn34Ws
- Tharkun 7y agoIt would be nice of my OS had an option to disallow any and all USB devices. Plug something in? Ask whether I want to allow it. I guess this would get annoying after a bit. But still, I only use a couple of USB devices on a daily basis, but I click on boatloads of cookie warnings every day.
- kalleboo 7y ago> It would be nice of my OS had an option to disallow any and all USB devices Any desktop computer would have to be redesigned to add a "allow new device" button since they have no other input. Even on many laptops, the internal keyboard and mouse are USB devices, when you install a new OS, do you have to accept trust to those as well? Or how will you stop an external device from spoofing them with the same vendor/device ID?
- derefr 7y agoHow about, trusted peripherals should speak DTLS over their USB/Thunderbolt PHY, and the OS should keep a certificate store for recognizing them? This sounds like something that creates a chicken-and-egg problem of there not already being any such DTLS-speaking USB devices... but how about if vendors just create a little USB dongle that wraps whatever's plugged into it in "authentication" using DTLS? Ship the dongle with the laptop; tell people that if they want to install a new OS, they have to plug a USB keyboard in through the dongle.
- yusyusyus 7y agomaybe not the exact correct solution (some of those MCUs are wayyyyy too tiny, slow, and stupid for something as complicated as DTLS), but this is not a horrid thought. The bootstrapping problem can be resolved via Microsoft's secureboot certificate and letting the firmware sort out the initial "trusted boot USB sticks" or however. hell, simply through acquisition and acquiescence, the market already accepted locked-down platforms. at this point, we ought to have more benefits from this instead of just making these platforms hard to install Linux on.
- 7y ago
- Faark 7y agoAt least the user should be informed, meaning it should show the bare minimum to allow us to act upon. Something like "USB keyboard connected: [Device specified name]" for common device types. More complicated/dangerous stuff should only run after user acknowledgement. This way there is at least a significant risk to get caught / chance for the user to catch it. Not sure if I just mis-configured my windows, but it is certainly lacking on that front. The Settings -> Devices -> USB having just a single checkbox for error popups is probably not a good sign.
- 3JPLW 7y agoOn a Mac, wouldn't this cause a "please identify this keyboard by pressing the key next to the shift key" prompt?
- paulsutter 7y agoI have never once wanted to attach a keyboard to my phone
- tenantless 7y agoThis cable targets the host computer it's plugged in to, not the phone.
- tsukurimashou 7y agoThe device shows up as a keyboard on your computer, not on your iphone
- abugheratwork 7y agoRegarding keyboards, maybe at least don't automatically trust a SECOND keyboard? Even when user interaction isn't possible until the device is active, as someone else pointed out, you can at least send a warning to the user's display.
- optimiz3 7y agoMy quick thought was to have the OS display a random char sequence, which must be typed on the keyboard before input is accepted. Usability could be optimized depending on how uniquely identifiable keyboards are (to reduce when trust prompts are shown).
- deleted 7y ago[deleted]
- falcolas 7y agoPersonal opinion: Charging only is what a cigarette adapter is for. Allowing me to use the car's interface to control my phone is a nice tool. It probably adds to the safety of my driving, since I can skip audio tracks using physical controls on my steering wheel instead of a touch screen.
- JadeNB 7y ago> Personal opinion: Charging only is what a cigarette adapter is for. But hardly any new cars have that …. > Allowing me to use the car's interface to control my phone is a nice tool. It probably adds to the safety of my driving, since I can skip audio tracks using physical controls on my steering wheel instead of a touch screen. It seemed that paulsutter (https://news.ycombinator.com/item?id=20686844 https://news.ycombinator.com/item?id=20686844) was suggesting a setting that prevents this automatically for people who never want it, not removing the capability for people like you who do want it.
- falcolas 7y ago> But hardly any new cars have that …. I'm in a 2019 Subaru Outback, and I have two. One for the front seat, one for the back. WRT a setting - CarPlay must be explicitly enabled, and has a per-vehicle pairing. I imagine Android has a similar requirement.
- deleted 7y ago[deleted]
- moftz 7y agoAndroid Auto bugs you every time you plug the phone into the car. I had a rental that had it and I was curious to try it since it seemed like something I may want in my next car. It was slow as fuck over bluetooth (a little faster over USB) and offered pretty much nothing more than what a magnetic mount and a bluetooth audio/phone connection would offer. It was 1000x quicker to just bring Waze up on my phone as I'm walking to the car, slap it on the magnet (up high on the dash, adjacent to the screen), and let the bluetooth connect automatically. I deleted the android auto profile and just stuck with regular bluetooth audio/phone.
- JustSomeNobody 7y agoI use a data blocker on anything I think might be suspect. But, then, I am shifting trust to my data blocker...
- optimiz3 7y agoWould be nice if they narrowed the attack surface - "A new (unneeded if devices sufficiently uniquely identifiable?) keyboard has been plugged in, please type <random char sequence> to confirm"
- bashinator 7y agoYou're on a desktop computer, and you've just spilled water on the keyboard. How do you replace it?
- josephg 7y agoYou plug in a USB keyboard. On the display it says "New USB keyboard detected! Type XYSJRF on the new keyboard to enable it". You type XYSJRF on the external keyboard and then use it like normal.
- CamperBob2 7y agoReally hate when I plug in my phone to charge in a car and the car takes over my UI. For every phone owner who thinks this way, there are probably a dozen others who hate it when they plug in their phone and the car doesn't mirror the phone's UI. I'd be in the latter group.
- NoodleIncident 7y agoIt sounds like you need a "USB Condom"; It's essentially a minimum-length extension cable, with only the power lines enabled, not any of the data.