4 ms·

How common is it though? This was my beef with Apple too, they add security to the point it was actively getting in my way. I'm sure my house would be more secu

How common is it though? This was my beef with Apple too, they add security to the point it was actively getting in my way. I'm sure my house would be more secure if I auto-locked every room and they all had seperate keys but it would also be incredibly annoying. I don't use a Mac anymore but does Apple also prompt you for plugging in say a Magic Mouse or Keyboard for pairing?

mwint 4y ago
They do.
AdamN 4y ago
Magic Mouse and Keyboard do not prompt once the relationship has been created over Bluetooth. Once they are disassociated, then you have to re-pair to get them on again.
acdha 4y ago
They definitely do prompt, because it’s not uncommon. There’s an entire cottage industry selling tools: https://shop.hak5.org/products/usb-rubber-ducky https://shop.hak5.org/products/usb-rubber-ducky More importantly, it puts you one hack away from arbitrary code execution. That device is a dedicated testing tool but there are tons of USB devices which have vulnerable firmware, and the OS vendor can’t know whether you’d pick up a USB key you find on the ground, buy a gadget off of Craigslist, or maybe you care about security but not enough to stop using Google Chrome and it turns out that one of your attached devices is exploitable via WebUSB/Bluetooth/MIDI/etc. but you won’t learn that until the next time you plug it in to charge it. Apple does prompt their devices, and if memory serves that’s for the same reason: USB isn’t authenticated so they can’t easily tell that a device claiming to be an Apple keyboard actually is.
- eviks 4y ago
  But how would the prompt help if the user plugging the off-the-ground USB key would just click yes?
  - acdha 4y ago
    It’s not foolproof but it gives people the opportunity to notice a problem and ask why something which isn’t a keyboard is trying to be one. The long-term fix is securing the USB protocol but when the deployed device count is measured in billions even a stopgap is useful.
    - eviks 4y ago
      > It’s not foolproof Then don't use a fool picking up USB keys from the ground to argue for this act of a security theater! > gives people the opportunity to notice a problem But it doesn't do that because constant nagging dulls the senses. Also, how do you expect the users to learn that he needs to be on the alert for keyboard mimics? Is there an emphasis on this in the warning? > long-term fix is securing the USB protocol but when the deployed device count is measured in billions even a stopgap is useful. long-term has already arrived: USB protocol is ancient. Meanwhile the gap is still there post Ventura
      - acdha 4y ago
        > Then don't use a fool picking up USB keys from the ground to argue for this act of a security theater! I didn't. Note the scenarios I gave included other things. Here's a good list to consider: one of your devices can be compromised in some other way (e.g. an IoT device which uses WiFi normally but charges or gets firmware updates over USB, a device which can be attacked via WebUSB & suborned), you have a friend / family member try to charge something unaware that their phone/tablet/etc. is compromised, or a device which you purchased unaware that it was compromised at the factory or while the previous owner had it. Note that none of those require malice or targeting: harder variants of this problem would be things like someone dropping a USB drive with your company's logo on it in the parking lot. That's a relatively cheap attack but at least you presumably have professionals working to prevent it whereas most home users do not. > But it doesn't do that because constant nagging dulls the senses. Just how frequently do you connect new USB HIDs? The system doesn't re-prompt devices you've used before so it's less “constant nagging” than “a couple of times over the lifetime of the device”. You appear to be having a very emotional reaction to this change – looking at your comment history shows a lot of anger and at least one time where you're angrily asking that Apple implement the current behaviour. I would suggest taking some time to cool down, think through what this actually does and some of the different scenarios other people have given you, and reconsider whether you really want to take such a strong position.
- goosedragons 4y ago
  I'm aware the tools exist but how actively exploited is it? Prompting you doesn't help in scenarios like buying a compromised gadget off Craiglist or a finding a USB key on the ground. The user is going to accept the prompt anyways to use it to begin with. Does it prompt you again if the USB devices firmware changes even while it's constantly plugged in? The only scenario I can see this being helpful is if someone is able to sneak an extra USB device or compromised cable onto your dock/desktop without you noticing but also can't unlock the computer to click OK. I'd imagine for the vast majority of people, even those that leave their computer at work 100% of the time that this is something they'll never encounter except maybe as a prank where the guy in accounting plugs in an extra mouse to mess with you. Perhaps it's worth the option but should it be the default? Even then I'd imagine a lot of people blindly clicking OK anyways...
  - acdha 4y ago
    > The user is going to accept the prompt anyways to use it to begin with. Some people will but some are going to ask why, changing this from a silent attack to one far more likely to be noticed and reported. That’s especially useful if you’re worried about widespread malware doing something like this to chain from a phone or some kind of IoT device to computers, or a factory in China being compromised but not noticing/caring until infected devices are all over Amazon. Long term, the protocol needs hardening but things like this help make those kind of problems visible. Apple has a range of users from people who aren’t targeted to those worried about hostile corporations or governments, and as other attacks get harder things like this become more appealing so it’s not surprising to see it getting hardened.
    - goosedragons 4y ago
      Why would they ask why when every new USB device they plug in gives an ultra generic warning asking to connect?
  - Avamander 4y ago
    It's difficult to say how common an attack is not having any visibility across other OSs and a hindrance (macOS) in the way. Same type of question with for example Secure Boot. Objectively we'd be worse off without, OS-ignored.

mwint 4y ago

They do.

AdamN 4y ago

Magic Mouse and Keyboard do not prompt once the relationship has been created over Bluetooth. Once they are disassociated, then you have to re-pair to get them on again.

acdha 4y ago

They definitely do prompt, because it’s not uncommon. There’s an entire cottage industry selling tools: https://shop.hak5.org/products/usb-rubber-ducky https://shop.hak5.org/products/usb-rubber-ducky More importantly, it puts you one hack away from arbitrary code execution. That device is a dedicated testing tool but there are tons of USB devices which have vulnerable firmware, and the OS vendor can’t know whether you’d pick up a USB key you find on the ground, buy a gadget off of Craigslist, or maybe you care about security but not enough to stop using Google Chrome and it turns out that one of your attached devices is exploitable via WebUSB/Bluetooth/MIDI/etc. but you won’t learn that until the next time you plug it in to charge it. Apple does prompt their devices, and if memory serves that’s for the same reason: USB isn’t authenticated so they can’t easily tell that a device claiming to be an Apple keyboard actually is.

eviks 4y ago
But how would the prompt help if the user plugging the off-the-ground USB key would just click yes?
- acdha 4y ago
  It’s not foolproof but it gives people the opportunity to notice a problem and ask why something which isn’t a keyboard is trying to be one. The long-term fix is securing the USB protocol but when the deployed device count is measured in billions even a stopgap is useful.
  - eviks 4y ago
    > It’s not foolproof Then don't use a fool picking up USB keys from the ground to argue for this act of a security theater! > gives people the opportunity to notice a problem But it doesn't do that because constant nagging dulls the senses. Also, how do you expect the users to learn that he needs to be on the alert for keyboard mimics? Is there an emphasis on this in the warning? > long-term fix is securing the USB protocol but when the deployed device count is measured in billions even a stopgap is useful. long-term has already arrived: USB protocol is ancient. Meanwhile the gap is still there post Ventura
    - acdha 4y ago
      > Then don't use a fool picking up USB keys from the ground to argue for this act of a security theater! I didn't. Note the scenarios I gave included other things. Here's a good list to consider: one of your devices can be compromised in some other way (e.g. an IoT device which uses WiFi normally but charges or gets firmware updates over USB, a device which can be attacked via WebUSB & suborned), you have a friend / family member try to charge something unaware that their phone/tablet/etc. is compromised, or a device which you purchased unaware that it was compromised at the factory or while the previous owner had it. Note that none of those require malice or targeting: harder variants of this problem would be things like someone dropping a USB drive with your company's logo on it in the parking lot. That's a relatively cheap attack but at least you presumably have professionals working to prevent it whereas most home users do not. > But it doesn't do that because constant nagging dulls the senses. Just how frequently do you connect new USB HIDs? The system doesn't re-prompt devices you've used before so it's less “constant nagging” than “a couple of times over the lifetime of the device”. You appear to be having a very emotional reaction to this change – looking at your comment history shows a lot of anger and at least one time where you're angrily asking that Apple implement the current behaviour. I would suggest taking some time to cool down, think through what this actually does and some of the different scenarios other people have given you, and reconsider whether you really want to take such a strong position.
goosedragons 4y ago
I'm aware the tools exist but how actively exploited is it? Prompting you doesn't help in scenarios like buying a compromised gadget off Craiglist or a finding a USB key on the ground. The user is going to accept the prompt anyways to use it to begin with. Does it prompt you again if the USB devices firmware changes even while it's constantly plugged in? The only scenario I can see this being helpful is if someone is able to sneak an extra USB device or compromised cable onto your dock/desktop without you noticing but also can't unlock the computer to click OK. I'd imagine for the vast majority of people, even those that leave their computer at work 100% of the time that this is something they'll never encounter except maybe as a prank where the guy in accounting plugs in an extra mouse to mess with you. Perhaps it's worth the option but should it be the default? Even then I'd imagine a lot of people blindly clicking OK anyways...
- acdha 4y ago
  > The user is going to accept the prompt anyways to use it to begin with. Some people will but some are going to ask why, changing this from a silent attack to one far more likely to be noticed and reported. That’s especially useful if you’re worried about widespread malware doing something like this to chain from a phone or some kind of IoT device to computers, or a factory in China being compromised but not noticing/caring until infected devices are all over Amazon. Long term, the protocol needs hardening but things like this help make those kind of problems visible. Apple has a range of users from people who aren’t targeted to those worried about hostile corporations or governments, and as other attacks get harder things like this become more appealing so it’s not surprising to see it getting hardened.
  - goosedragons 4y ago
    Why would they ask why when every new USB device they plug in gives an ultra generic warning asking to connect?
- Avamander 4y ago
  It's difficult to say how common an attack is not having any visibility across other OSs and a hindrance (macOS) in the way. Same type of question with for example Secure Boot. Objectively we'd be worse off without, OS-ignored.