4 ms·

My laptop has a built-in keyboard and trackpad, so why doesn't it just ask my permission to use any USB device I plug in? I don't know if there's a way to uniqu

My laptop has a built-in keyboard and trackpad, so why doesn't it just ask my permission to use any USB device I plug in? I don't know if there's a way to uniquely fingerprint a USB device, but if there is then I could tell the OS to always trust particular devices to make it more convenient.

younata 15y ago
Each USB device has it's own unique ID, so yeah, it should be possible.
- jbri 15y ago
  When you're dealing with a malicious attacker, you can't assume that they're playing by the rules. All an attacker would have to do is find the ID of a device that you have used in the past.
  - extension 15y ago
    If an attacker can get the USB ID of a device physically attached to your computer then he probably already has access to your computer.
eridius 15y ago
Why would it ask? If you didn't want the computer to access the drive, then why did you plug it in? The mere act of plugging in a drive is a signal to the computer that you want the drive to be made available. Note, however, that this is NOT a signal that you want the computer to start running arbitrary software on the drive.
- jbri 15y ago
  And what if you've plugged in a USB keyboard at the same time as that drive? And that USB keyboard has said "hey yes I want to run the software on this drive"?
  - eridius 15y ago
    And how does the USB Keyboard have the permission to go ahead and launch software on the user's behalf? It's precisely the same issue as autorun on a thumb drive.
- burgerbrain 15y ago
  This is assuming the hardware is as presents itself.
- ordinary 15y ago
  There are plenty of times in which what the computer is told to do (and consequently does, as is their wont) is not the same as what the user might WANT it to do. Compare the computer: "The user runs this program, the program tells me to wipe the hard drive, I wipe the hard drive", and the user: "I just downloaded Medal of Honor and I want to play it". Another example: the computer: "The user entered 'rm -rf doc', I delete ./doc/", and the user: "I want to get rid of 'Documents/' for the 23rd time today and execute 'rm -rf doc<tab>'". The discrepancy between "do what I say" and "do what I mean" is part of where security lives. In the above cases, that would be a virus scanner and your favourite *nix command line trash utility, respectively. Other examples can easily be imagined. Just because a user tells you to do something doesn't mean they want you to do it.

younata 15y ago

Each USB device has it's own unique ID, so yeah, it should be possible.

jbri 15y ago
When you're dealing with a malicious attacker, you can't assume that they're playing by the rules. All an attacker would have to do is find the ID of a device that you have used in the past.
- extension 15y ago
  If an attacker can get the USB ID of a device physically attached to your computer then he probably already has access to your computer.

eridius 15y ago

Why would it ask? If you didn't want the computer to access the drive, then why did you plug it in? The mere act of plugging in a drive is a signal to the computer that you want the drive to be made available. Note, however, that this is NOT a signal that you want the computer to start running arbitrary software on the drive.

jbri 15y ago
And what if you've plugged in a USB keyboard at the same time as that drive? And that USB keyboard has said "hey yes I want to run the software on this drive"?
- eridius 15y ago
  And how does the USB Keyboard have the permission to go ahead and launch software on the user's behalf? It's precisely the same issue as autorun on a thumb drive.
burgerbrain 15y ago
This is assuming the hardware is as presents itself.
ordinary 15y ago
There are plenty of times in which what the computer is told to do (and consequently does, as is their wont) is not the same as what the user might WANT it to do. Compare the computer: "The user runs this program, the program tells me to wipe the hard drive, I wipe the hard drive", and the user: "I just downloaded Medal of Honor and I want to play it". Another example: the computer: "The user entered 'rm -rf doc', I delete ./doc/", and the user: "I want to get rid of 'Documents/' for the 23rd time today and execute 'rm -rf doc<tab>'". The discrepancy between "do what I say" and "do what I mean" is part of where security lives. In the above cases, that would be a virus scanner and your favourite *nix command line trash utility, respectively. Other examples can easily be imagined. Just because a user tells you to do something doesn't mean they want you to do it.