4 ms·

Of these, I think the only one that can work solely because of an overly "flexible in what you receive" is the USB condoms, which shouldn't be encouraged in the

Of these, I think the only one that can work solely because of an overly "flexible in what you receive" is the USB condoms, which shouldn't be encouraged in the first place. Specifically, that people wanted to charge at more than 100mA without doing real negotiation, so they ignored official USB specs came up with a variety of static or simpler negotiations that could be mimicked. The un-negotiated 20V power input is a WTF and I've never seen that before, but the typical behavior from a port not expecting that is getting fried so it's not like anyone else is being overly liberal. The extension cable works because basically all physical connections from the last 30 years or so are designed to still try to work at a degraded level with subpar signal integrity, because the world is analogue and you can't have a 100% perfect signal. The sometimes missing pins can't be required without breaking compatibility with pre-C ports that don't have them. Likewise, the male-A to female-C adapter can't really be distinguished from a male-A to male-C cable, so you can't prevent it from working without also blocking those cables. IMO the real issue is the USB-IF stubbornly refusing to allow any legit versions of an extension cable (or I guess male-A to female-C) with active circuitry to make them reliable/safe. A hub allows male-A to male-A connections and length extension after all...

2muchcoffeeman 4y ago
I think the solution to charging from an untrusted port is a power bank. Mine will pass through power to my device if the device needs charging. If not, it will recharge itself. It's also powerful enough to recharge a tablet and I think my M2 Air. I bought the power bank from a well known brand, and I've tried charging it from different supplies. It seems to negotiate the power to charge itself correctly. And my devices just detect it as a power supply. It has wireless charging for phones too.
- brigade 4y ago
  The right solution is not thinking about it at all. The only extant malicious chargers anyone has shown evidence of have been proof-of-concepts whose concept hasn't worked in nearly a decade. If you're worried about purely theoretical attacks, you should also be worried about your power bank's firmware being infected from the malicious port and subsequently infecting your phone.
alerighi 4y ago
Like any connector that is mass produced it tends to be cheap and with good cables at very small price and thus people tend to use it for other purposes like the 20V input. Well as RJ45 used for serial connections, passive PoE standards that will put 24V on whatever you connect no matter that it can handle it, audio jacks used for analog video or even power, and similar stuff. It’s not obvious that if a connector fits it will work! Is it wrong? To me not, you have to be careful, just as you can plug a 3kW space heater with an extension cord with a 0.75mm2 cable and burn your house down you can use the wrong usb C connector (that will unlikely start a fire)

2muchcoffeeman 4y ago

I think the solution to charging from an untrusted port is a power bank. Mine will pass through power to my device if the device needs charging. If not, it will recharge itself. It's also powerful enough to recharge a tablet and I think my M2 Air. I bought the power bank from a well known brand, and I've tried charging it from different supplies. It seems to negotiate the power to charge itself correctly. And my devices just detect it as a power supply. It has wireless charging for phones too.

brigade 4y ago
The right solution is not thinking about it at all. The only extant malicious chargers anyone has shown evidence of have been proof-of-concepts whose concept hasn't worked in nearly a decade. If you're worried about purely theoretical attacks, you should also be worried about your power bank's firmware being infected from the malicious port and subsequently infecting your phone.

alerighi 4y ago

Like any connector that is mass produced it tends to be cheap and with good cables at very small price and thus people tend to use it for other purposes like the 20V input. Well as RJ45 used for serial connections, passive PoE standards that will put 24V on whatever you connect no matter that it can handle it, audio jacks used for analog video or even power, and similar stuff. It’s not obvious that if a connector fits it will work! Is it wrong? To me not, you have to be careful, just as you can plug a 3kW space heater with an extension cord with a 0.75mm2 cable and burn your house down you can use the wrong usb C connector (that will unlikely start a fire)