9 ms·
While it's a fascinating project I'd have some security concerns about plugging someone's USB business card into my computer.
by nilsb 7y ago
While it's a fascinating project I'd have some security concerns about plugging someone's USB business card into my computer.
- chrisseaton 7y agoThat’s if you even have a USB A socket anymore!
- cerberusss 7y agoI don't see why you were downvoted. I fully get why the blog writer didn't include USB-C with this awesome project. But there's now a growing group of people who simply can't use USB-A anymore with their laptops. Most will have an adapter, but not all.
- deleted 7y ago[deleted]
- jmgao 7y agoI've played around putting USB connectors directly on PCBs, and USB-A is way more lenient than USB-C. With USB-A, you can use basically any PCB thickness between the standard 1.6mm and 2.2mm, and it'll work well enough. USB-C's midplate is specified at 0.7mm, and all of the cheap chinese PCB manufacturers only offer 0.6mm and 0.8mm. 0.6mm is too thin to make reliable contact with most of the cables I've tried: I haven't gotten around to ordering another batch at 0.8mm, but plugging the corner of a 0.8mm M.2 SSD into a USB-C cable, it's pretty (i.e. probably slightly too) snug. Thin PCBs are also extremely flexible, which isn't great for brittle solder joints, ceramic capacitors, etc.
- jimmaswell 7y agoWhat an absurd tragedy. Everyone was just fine with usb-A and ethernet ports and hdmi but no, now these laptops need dongles for literally everything.
- cerberusss 7y agoAbsurd tragedy? Maybe for you. For me, it's been a good life since the 2016 MacBook Pro. I got a decent dock, and connect everything with a single cable.
- heavenlyblue 7y agoI would assume you paid a good $150 for one, given that the others either don’t supply enough power or can’t do 4K@60.
- cerberusss 7y agoMore. I paid 250 euros for a CalDigit TS3 Plus. Thing is amazing. When I first got my MacBook Pro, I just got USB-C cables for my external monitor and my (USB-A) hub. That was very cheap, but I love the convenience of Thunderbolt and shelled out the cash.
- heavenlyblue 7y agoI am struggling to find good info - does usb-c support more than one display on one cable at 4k@60?
- cerberusss 7y agoYup, all Thunderbolt 3 docks support two 4K displays @ 60 Hz.
- chrisseaton 7y agoUSB-A is not 'just fine'. It's uni-directional. Which is an insane design for something being constantly plugged in and out. It's also low-bandwidth and low-power. Most devices these days have bluetooth, so it isn't really needed except for power and monitors. USB-C is a step-up in everything and I'm happy with only USB-C.
- 7y ago
- KMnO4 7y agoWhile this is generally true, I think it’s less true for embedded systems. All of the tools I use at work for embedded systems engineering (JLink, serial adapter, oscilloscope, logic analyzer, nearly all MCU dev boards and FPGAs) are USB-A. I use a MBP and simply could do any work whatsoever without a USB hub. I think it’s fair to assume anyone in the industry can use USB-A.
- cerberusss 7y agoIn the industry, yes, I agree. Except for maybe managers but even they probably have a dock on their desk that includes USB-A. Edit: I remember something, having done work related to embedded stuff. About 6 years ago, we still had 3.5" floppy drives in a couple of scopes in the lab. We replaced those with a device that internally had the interface of a 3.5" floppy drive, but on the outer faceplate it had a USB-A connector for thumb drives.
- xen2xen1 7y agoI would assume someone doing embedded work would not only have to have USB, but serial. Is that incorrect? It seemed like that was even included in your list?
- stephen_g 7y agoI usually have two or three USB to serial converters plugged into my computer at work at any time. I expect most embedded people would do similar (or use serial console servers over a network).
- monocasa 7y agoA female to C male adapters exist, but C female to A male adapters are forbidden by the spec. That means you need to create A peripherals if you want the largest audience.
- kccqzy 7y agoAre you sure this is the case? I bought a couple of these to have newer peripherals work on my older laptop.
- monocasa 7y agoYeah, they sell them but they're not supposed to. It's because putting an A on each end of a C cable and connecting two A hosts together can destroy the two A hosts. Practically, since you can find them as you say, is that as a peripheral vendor in the west, you can't ship a C device with a C to A plug because you'll lose your license.
- rvz 7y agoFrom the project webpage: > It has a USB port in the corner. If you plug it into a computer, it boots in about 6 seconds and shows up over USB as a flash drive and a virtual serial port that you can use to log into the card's shell. The parent of this thread has a valid point here and the insecurity implications of this is nefarious if one isn't careful. While it is a technically cool fun project, I can imagine a bad actor taking this to DEFCON/CCC or even a tech-centric concert and mass producing this to emulate a USB drive, but is also a keylogger or a remote access tool of some sort which reminds me of the nightmares of BadUSB.
- gokhan 7y agoYou and your parent clearly shows the current boring, uninspiring state of HN community. Well done. Now, where is the predictible sandboxing guy to counter your predictible "security implications" argument?
- aliswe 7y agoSort of agree, but the "well done" part in your reply also represent a sad aspect of HN, in my view
- gokhan 7y agoYes, you're right. Can't edit it out, sorry.
- 6510 7y agoI'm worried that the potential employer infects the card, uses it to take over their competitor personal computer network and appends: "Don't forget! The S in IoT stands for Security!" to all of their documents and audio files. Then the traffic lights after we colonize mars will be like "It is safe to cross. Don't forget!..." and some ATM on the moon will be like "Thanks for using the bank of the moon. Don't forget!..."
- jaclaz 7y agoWell, it is appropriate as a business card for an embedded systems engineers, not so much for a system security one! More seriously, I never managed to understand the "obsession" with ROHS (this here is just an example): >I made sure to have a lead-free process—the boards, parts, and solder paste are all RoHS—so that I wouldn't feel bad about giving them to people. I mean, you are creating something that (besides being very nice) is not needed, that very likely will end soon in the trash (and that contains anyway a few grams of "far from clean" materials) and you worry about the tiny amount of lead in the solder tin?
- smitty1e 7y agoWere I a system security engineer, I should think I'd have a sanitized way to plug in a USB device. How else would one do forensics?
- jaclaz 7y agoI meant - jokingly - the opposite, i.e. you call for a consultancy a security engineer as you are interested in increasing/bettering the digital security level of your business and he produces to you the Linux USB business card, you proceed to insert it in your computer and he says: "Ah-ha!" Reference: https://www.imdb.com/title/tt0094898/quotes/qt1099763 https://www.imdb.com/title/tt0094898/quotes/qt1099763
- Thriptic 7y agoIn fact, a USB condom would be a nice variant of this project for a security engineer's business card, although the female USB portion might be a bit bulky for practical use.
- Aardwolf 7y agoI think it's very considerate to not add lead to a business card people may put in their pockets.
- jaclaz 7y agoSure, the lead may cross one or two layers of cloth and migrate from the pocket to your skin and bite you. More considerate would be to provide the card in a protecting sleeve (that would protect from all the bad, bad substances it may contain) or just use a good, ol' plain paper business card, posibly printed with "bioetical" ink.
- nickthemagicman 7y agoThat was my first thought. If someone gave me this at defcon I would not use it.
- aperrien 7y agoWould you use anything given to you from a random individual at defcon?
- berbec 7y agoIn an airgapped VM, on someone else's hardware? Probably not even then!
- nickthemagicman 7y agoHaha very good point! I would barely feel comfortable about a regular business card.
- jbverschoor 7y agoIs that really the responsibility of the person making the card? This is the responsibility of the creators of the USB hardware, firmware, motherboard firmware, electrical design, OS developers / driver developers. It should be safe to plug in a USB device by default
- ohazi 7y agoshould be safe, in theory, sure. But in practice?
- jbverschoor 7y agoThen we should stop any form of communication. In practice it can be safe on multiple levels. He could’ve also just put some malware I. A pdf or word document, as word is what recruiters want.
- blotter_paper 7y agoThe whole beauty of USB ports is that we have one unified interface for practically everything. It can't be safe without giving that up, adding some friction to user interaction, or doing some dark art involving centrally signed devices that we expect won't be broken. If anybody can produce storage and input devices that plug into a universal port and just work, malicious input devices can be made to physically look like storage devices in the eyes of the user. I'm not saying we shouldn't make more security conscious tradeoffs, I'm just saying that there are tradeoffs to be made, and most users probably won't appreciate the added friction.
- taneq 7y agoIf their business card hires them, they’re hired!
- jlg23 7y agoOTOH, a security conscious engineer could exploit this to have the business card call home and automatically block communications from the company so one does not waste time with them ;)
- jacquesm 7y agoI'd say that's a business opportunity lost.
- blotter_paper 7y agoIt would be funny to have the business card list known exploits on their system -- whether this would taken lightly by the hiring manager is another question.
- jacquesm 7y agoPentest-by-business-card-as-a-service. Awkward acronym, probably not going to be a commercial success.
- GhettoMaestro 7y agoAnd just like that, you committed a felony.
- JasonFruit 7y agoProbably your second today, to be fair.
- GhettoMaestro 7y agoWrong. Second this minute. (420 my man - fuck da US Gov in this respect - they do not have sovereignty over your body or mine)
- kortilla 7y agoNot a felony if it transmits over a cell network that the usb interface was activated.
- boublepop 7y agoethernet on a business card is just not as viable.
- RodgerTheGreat 7y agoPerhaps you could do something like this, incorporating the jack into the PCB instead of an elevated component? https://upload.wikimedia.org/wikipedia/commons/d/df/XJACK_network_card_extended.jpg https://upload.wikimedia.org/wikipedia/commons/d/df/XJACK_ne...
- IgorPartola 7y agoIt would be pretty sweet if it was Bluetooth instead. A Bluetooth serial console would be pretty kickass.
- amelius 7y agoThen build an embedded system to plug it into ...