3 ms·

This thread clearly shows that even in 2023 people still don't understand USB attack vectors and still think this is some evil move by Apple to degrade the user

by siva7 4y ago

This thread clearly shows that even in 2023 people still don't understand USB attack vectors and still think this is some evil move by Apple to degrade the user experience

RedShift1 4y ago
I understand what's going on but how does asking the user for permission help? They're just going to click accept, ok, whatever to continue working. I doubt the user will even understand what's going on.
- sergiomattei 4y ago
  > Leaves laptop on desk, goes to bathroom. > Bad actor plugs in device. Pwned. This is why asking to allow works as a security measure.
  - flohofwoe 4y ago
    In that case the machine would be locked and no new USB connections should be accepted in locked state? And if the computer isn't locked during your bathroom break, the "bad actor" can do whatever he wants anyway, including clicking the Ok button after inserting the USB device. But in general, yeah, an USB popup is the least of Ventura's problems (the much bigger problem is the slow but steady "iOS-ification" of macOS).
    - celeritascelery 4y ago
      > In that case the machine would be locked and no new USB connections should be accepted in locked state? Until you get back and unlock the device. Or if you have a usb hub it is possible for someone to plug something in without your knowledge while using the device.
      - eviks 4y ago
        > Until you get back and unlock the device then show the popup at unlock! still doesn't explain the usefulness of the original popup
        jen20 4y ago
        Isn’t that.. exactly what it being complained about?
        MichaelZuo 4y ago
        The popup still appears even if the computer was unlocked the entire time.
    - AnIdiotOnTheNet 4y ago
      [flagged]
- ultrarunner 4y ago
  It's not hard for a device to reenumerate with a different device descriptor. With Ventura that needs confirmation, which is probably the right response.
specialist 4y ago
I assume the improved USB security is a) response to actual attacks (which Apple understandably doesn't want to publicize), b) fulfilling every more rigorous corporate and government criteria, or c) both. I'm fine with it. Every thing Apple does to postpone my eventual pwning suits me just fine.
- AnIdiotOnTheNet 4y ago
  Just turn your computer off. Pwning is thus postponed indefinitely. ...oh, you wanted to get work done too? Well, now we have to compromise some things.

by siva7 4y ago

This thread clearly shows that even in 2023 people still don't understand USB attack vectors and still think this is some evil move by Apple to degrade the user experience

RedShift1 4y ago

I understand what's going on but how does asking the user for permission help? They're just going to click accept, ok, whatever to continue working. I doubt the user will even understand what's going on.

sergiomattei 4y ago
> Leaves laptop on desk, goes to bathroom. > Bad actor plugs in device. Pwned. This is why asking to allow works as a security measure.
- flohofwoe 4y ago
  In that case the machine would be locked and no new USB connections should be accepted in locked state? And if the computer isn't locked during your bathroom break, the "bad actor" can do whatever he wants anyway, including clicking the Ok button after inserting the USB device. But in general, yeah, an USB popup is the least of Ventura's problems (the much bigger problem is the slow but steady "iOS-ification" of macOS).
  - celeritascelery 4y ago
    > In that case the machine would be locked and no new USB connections should be accepted in locked state? Until you get back and unlock the device. Or if you have a usb hub it is possible for someone to plug something in without your knowledge while using the device.
    - eviks 4y ago
      > Until you get back and unlock the device then show the popup at unlock! still doesn't explain the usefulness of the original popup
      - jen20 4y ago
        Isn’t that.. exactly what it being complained about?
        MichaelZuo 4y ago
        The popup still appears even if the computer was unlocked the entire time.
  - AnIdiotOnTheNet 4y ago
    [flagged]
ultrarunner 4y ago
It's not hard for a device to reenumerate with a different device descriptor. With Ventura that needs confirmation, which is probably the right response.

specialist 4y ago

I assume the improved USB security is a) response to actual attacks (which Apple understandably doesn't want to publicize), b) fulfilling every more rigorous corporate and government criteria, or c) both. I'm fine with it. Every thing Apple does to postpone my eventual pwning suits me just fine.

AnIdiotOnTheNet 4y ago
Just turn your computer off. Pwning is thus postponed indefinitely. ...oh, you wanted to get work done too? Well, now we have to compromise some things.