4 ms·

I didn’t think the device had any way of telling if the cable was malicious. So even if it wouldn’t ask repeatedly, you wouldn’t know if the cable was evil? So

I didn’t think the device had any way of telling if the cable was malicious. So even if it wouldn’t ask repeatedly, you wouldn’t know if the cable was evil? So I’m not sure if the question “do you trust the device you just plugged in” does much of anything other than giving you a chance to reconsider? Also, is there a chance that the trust is lost on a weird AI timer? For example, a little while ago, my phone asked, if I wanted an alarm set to a specific time on a specific weekday morning, apparently just because I needed such an alarm for 2 weeks in a row. That made the pattern easy to recognize, but it also told me that the phone AI is trying too hard to learn about me. - I assume you’re always using the same cable? And I also assume you don’t get the trust dialog when plugging into a wall charger directly?

lisper 7y ago
> I didn’t think the device had any way of telling if the cable was malicious. Well, no, but I assume it has a way of knowing if the computer I'm plugging it in to now is the same one that I plugged it in to yesterday and that I told it to trust yesterday. The cable I'm using is the one that came with the phone, so if it was malicious that would be big news. But I just realized that I left out an important detail: my phone is not plugged directly into my computer, but is instead connected through a USB hub and an OWC Thunderbolt dock. So that muddies the waters considerably. It is not at all out of the question that one of those devices is doing something hinky, though I'll give long odds against. > is there a chance that the trust is lost on a weird AI timer? Extremely unlikely. This one computer is the only one my phone has ever been plugged in to (AFAIK). > I assume you’re always using the same cable? And I also assume you don’t get the trust dialog when plugging into a wall charger directly? Correct on both counts.
- noizejoy 7y ago
  Wow - it’s a strange one indeed. Your use case doesn’t even strike me as that far from a pretty normal scenario. But it illustrates, how much potential for malfeasance is introduced with the chains of “smart” components that we’re increasingly required to use. And even being vigilant becomes difficult to impossible, because there are just too many vectors of vulnerability. Kinda depressing...
  - lisper 7y ago
    It is indeed. (The most depressing thing to me is that people actually pay money for devices like Alexa and Google Voice which are designed to spy on them. Who needs to become a hacker when people will voluntarily give up their privacy for a shiny thing?)
    - noizejoy 7y ago
      They probably didn’t read George Orwell in their formative years :-/
  - lisper 7y ago
    Just for the record: I just unlocked my phone after it was plugged in to my computer all night and it put up the "trust this computer?" dialog. I did not confirm. Instead, I turned the phone off, and plugged it back in directly to my computer without the intervening hub and dock. This time it did NOT put up the trust dialog. I plugged it back in to the hub and it once again did NOT put up the dialog. It's very weird, and the fact that the trust dialog does not display any kind of device fingerprint makes it impossible to know what is actually going on.
    - noizejoy 7y ago
      just wow - that’s pretty crazy - it sure would be interesting to find out what signals the logic/code behind the trust dialog actually looks for, and maybe even more interesting why it was designed that way, or if it’s just really buggy.

lisper 7y ago

> I didn’t think the device had any way of telling if the cable was malicious. Well, no, but I assume it has a way of knowing if the computer I'm plugging it in to now is the same one that I plugged it in to yesterday and that I told it to trust yesterday. The cable I'm using is the one that came with the phone, so if it was malicious that would be big news. But I just realized that I left out an important detail: my phone is not plugged directly into my computer, but is instead connected through a USB hub and an OWC Thunderbolt dock. So that muddies the waters considerably. It is not at all out of the question that one of those devices is doing something hinky, though I'll give long odds against. > is there a chance that the trust is lost on a weird AI timer? Extremely unlikely. This one computer is the only one my phone has ever been plugged in to (AFAIK). > I assume you’re always using the same cable? And I also assume you don’t get the trust dialog when plugging into a wall charger directly? Correct on both counts.

noizejoy 7y ago
Wow - it’s a strange one indeed. Your use case doesn’t even strike me as that far from a pretty normal scenario. But it illustrates, how much potential for malfeasance is introduced with the chains of “smart” components that we’re increasingly required to use. And even being vigilant becomes difficult to impossible, because there are just too many vectors of vulnerability. Kinda depressing...
- lisper 7y ago
  It is indeed. (The most depressing thing to me is that people actually pay money for devices like Alexa and Google Voice which are designed to spy on them. Who needs to become a hacker when people will voluntarily give up their privacy for a shiny thing?)
  - noizejoy 7y ago
    They probably didn’t read George Orwell in their formative years :-/
- lisper 7y ago
  Just for the record: I just unlocked my phone after it was plugged in to my computer all night and it put up the "trust this computer?" dialog. I did not confirm. Instead, I turned the phone off, and plugged it back in directly to my computer without the intervening hub and dock. This time it did NOT put up the trust dialog. I plugged it back in to the hub and it once again did NOT put up the dialog. It's very weird, and the fact that the trust dialog does not display any kind of device fingerprint makes it impossible to know what is actually going on.
  - noizejoy 7y ago
    just wow - that’s pretty crazy - it sure would be interesting to find out what signals the logic/code behind the trust dialog actually looks for, and maybe even more interesting why it was designed that way, or if it’s just really buggy.