4 ms·

What does that solve though? I don't NEED a mouse to copy data.

by swalsh 6y ago

jrott 6y ago
It doesn’t solve for an outsider or malicious employee getting access to a machine. What it does solve for is an employee plugging in a compromised usb device on accident since they probably won’t unplug there keyboard or mouse for it.
dhosek 6y ago
It solves the "I found this USB stick in the parking lot—let me plug it in to see what's on it" problem.
- icedchai 6y ago
  Sure, if they don't have a USB hub sitting around.
  - muttled 6y ago
    If my experience with users holds true, they'll abandon the quest at the first obstacle and the USB will harmlessly sit in a desk drawer for the rest of time.
  - dhosek 6y ago
    The closest thing to a USB hub I've got is one of my external drives for my Mac Mini has a built in USB hub so I can plug stuff into that as well as directly into the computer. The last time I worried about such things was back when desktop computers only had one or two USB ports. Plus, in a DoD situation, I'd imagine that having your own USB hub plugged into a DoD computer would be the kind of thing that could put your job at risk. A friend who teaches at the Naval War College often laments the unusability of DoD IT because of the level of locking down, but any "Why don't you do X?" suggestions have a response of "I'd get fired." The safeguard doesn't need to be perfect, it just has to be good enough.
- strbean 6y ago
  They'll just unplug the mouse and plug in the drive to see what happens!
sramam 6y ago
I'd think guardrails like this also serve at a psychological level - as in "this is a secure machine, don't try to break rules". While these second order effects are immeasurable, they are quite tangible in my personal experience.
acdha 6y ago
It solves two problems: one is someone covertly or foolishly plugging in an untrusted USB device (which might be easily missed on, say, the back of a desktop) and it means that checking to make sure that only a keyboard or mouse are attached is as simple as putting tamper-evident seals on those cables. Attempting to authenticate USB devices is a very hard problem — a sufficiently advanced attacker can spoof manufacturer and device IDs, even if you lock things down to prevent anything other than a keyboard or mouse it's possible to send keystrokes to open the wrong website, there's always a chance of an exploitable flaw in your USB stack, etc. — but anyone diligent can be paid to walk around every week checking to make sure that a seal is solid and the tamper-evident stickers have the same serial number as listed on the inventory. There is a real value in having things where the failure modes are obvious and intuitive.

What does that solve though? I don't NEED a mouse to copy data.

by swalsh 6y ago

What does that solve though? I don't NEED a mouse to copy data.

It doesn’t solve for an outsider or malicious employee getting access to a machine. What it does solve for is an employee plugging in a compromised usb device on accident since they probably won’t unplug there keyboard or mouse for it.

dhosek 6y ago

It solves the "I found this USB stick in the parking lot—let me plug it in to see what's on it" problem.

icedchai 6y ago
Sure, if they don't have a USB hub sitting around.
- muttled 6y ago
  If my experience with users holds true, they'll abandon the quest at the first obstacle and the USB will harmlessly sit in a desk drawer for the rest of time.
- dhosek 6y ago
  The closest thing to a USB hub I've got is one of my external drives for my Mac Mini has a built in USB hub so I can plug stuff into that as well as directly into the computer. The last time I worried about such things was back when desktop computers only had one or two USB ports. Plus, in a DoD situation, I'd imagine that having your own USB hub plugged into a DoD computer would be the kind of thing that could put your job at risk. A friend who teaches at the Naval War College often laments the unusability of DoD IT because of the level of locking down, but any "Why don't you do X?" suggestions have a response of "I'd get fired." The safeguard doesn't need to be perfect, it just has to be good enough.
strbean 6y ago
They'll just unplug the mouse and plug in the drive to see what happens!

sramam 6y ago

I'd think guardrails like this also serve at a psychological level - as in "this is a secure machine, don't try to break rules". While these second order effects are immeasurable, they are quite tangible in my personal experience.

acdha 6y ago

It solves two problems: one is someone covertly or foolishly plugging in an untrusted USB device (which might be easily missed on, say, the back of a desktop) and it means that checking to make sure that only a keyboard or mouse are attached is as simple as putting tamper-evident seals on those cables. Attempting to authenticate USB devices is a very hard problem — a sufficiently advanced attacker can spoof manufacturer and device IDs, even if you lock things down to prevent anything other than a keyboard or mouse it's possible to send keystrokes to open the wrong website, there's always a chance of an exploitable flaw in your USB stack, etc. — but anyone diligent can be paid to walk around every week checking to make sure that a seal is solid and the tamper-evident stickers have the same serial number as listed on the inventory. There is a real value in having things where the failure modes are obvious and intuitive.