4 ms·

An OS doesn't even need to implement USB support. Of course it can offer access controls to enable the USB devices.

• tjader 5y ago
  Of course not, but then you're saying USB is a security flaw. My point is that given how universal USB as long as a device can do both input and output it's going to be very hard to stop some exfiltration from being possible. Do you really think a bug report should be filed on all OS's for allowing USB drives and keyboards to be plugged on a running system?
  • matheusmoreira 5y ago
    > you're saying USB is a security flaw It is. > Do you really think a bug report should be filed on all OS's for allowing USB drives and keyboards to be plugged on a running system? Automatically trusting input devices is as bad as trusting user input. It's trivial to pass off a programmable USB keyboard as a mass storage device.
  • DarylZero 5y ago
    I was saying that the existence of the non-implementation of USB proves the possibility of access controls on USB. Convoluted way to put it I guess. For some reason was intuitive to me (proof of existence by example, more trivial example better). Having access controls on USB-HID is just a local policy choice where most people would choose convenience over security.
    • tjader 5y ago
      I agree, and it makes sense for some security oriented OS. But the comment I replied to seemed to suggest that the possibility of data exfiltration via USB is a bug in any OS.