5 ms·

I might be the exception here, but IMHO it is pretty patronizing how non-technical people are expected to keep up with the digital security landscape. Instead o

by moring 4y ago

I might be the exception here, but IMHO it is pretty patronizing how non-technical people are expected to keep up with the digital security landscape. Instead of building devices in a way that, of all things, charging them cannot hack them, we expect everybody to know that this is even a thing. What are even the chances of this security "strategy" being successful? I'd like to suggest a mental exercise here: Just imagine that every discipline (mechanical, medical, legal, electrical, ...) comes up with new rules to follow every month that interfere with everyday tasks that you have to perform (such as handling your bank account), but you only know about these rules when you actively research them and if you break a single rule, you are in danger of your possessions being taken away from you.

ChuckNorris89 4y ago
>building devices in a way that, of all things, charging them cannot hack them Affordability, convenience, security. Choose two. It's not patronizing, it's how the consumer electronics market works and how consumers vote with their wallet. Consumer device are sold with USB cables that pass data and power lines for cost and convenience, so they can also transfer data while also charging their device with the same cable that came in the box and not have them go out and buy another cable. Can you imagine being sold a phone who's cable only passed power lines and not data, "for your own security"? The consumer confusion and outrage would be massive. If your threat model seama it, the solution is buying a USB condom which only passe through the power lines, not the data ones. Just like the internet and TCP-IP, USB was designed from the start to be as cheap and convenient as possible, before anything else, to get market traction, which it did. Security concerns came much later.
- moring 4y ago
  I'd like to extend my thought experiment with professionals from all disciplines explaining why this is not patronizing at all and why it is exactly what consumers want.
- antihipocrat 4y ago
  Why can't the device being charged provide an option, such as charge only by default - and the user can turn on data transfer the same way we turn flight mode on and off?
  - ChuckNorris89 4y ago
    Android allows that in settings. But AFAIK it's just a software setting, the data lines are still physically connected. The reason why there's no physical hard disconnect available in settings comes back to what I said earlier, cost and convenience from the manufactures' perspective. They don't want to spend 2 cents on some mosfets for HW disconnects, and they don't want to nag the user every time they plug in the phone to charge as that would hurt the UX. They want the device to sync up automagically to whatever device you're pugging it into. That's what USB was designed for, convenience. Plus, if you nag the user every single time they plug in the USB with a security prompt, they will just get desensitized and instinctively click 'YES' all the time.
    - olabyne 4y ago
      You also need to have the USB connected on boot, for update/flash purpose.
    - deleted 4y ago
      [deleted]
  - rjh29 4y ago
    That is what my android phone does, I have to toggle it to allow data every time.
  - NavinF 4y ago
    Funny you mention that when literally all flagship phones (both iOS and Android) have a "Do you trust this computer?" popup that does exactly what you described. By default, phones don't do any data transfer over USB.
    - iavael 4y ago
- pengaru 4y ago
  > Can you imagine being sold a phone who's cable only passed power lines and not data, "for your security"? The consumer confusion and outrage would be massive. I can imagine a phone sold with a readily accessible and highly visible physical toggle switch for power-only mode, giving consumers a discoverable built-in USB condom.
  - ChuckNorris89 4y ago
    You can imagine it. But can you imagine Apple, the "everything works automagically that we don't even give you basic setting in the SW" company, actually selling something like that to consumers? It would be a heresy to everything they stand for in terms of UX and physical device design.
    - carlitossway 4y ago
      The toggle on and off switch would be very unApplely, yes. That does not mean you have to stop thinking, it means you need industrial designers on board. USB-condoms are a thing you know; average (and below) users know exactly what those do and can figure out how to use them in a few seconds. I bet if Apple's genius marketeers would come up with a catchy name (like the i-Safe, but cooler) those would easily sell at 3,000% the production cost. But they never will because they tarnish the brand, and make the users think their devices are not safe by default. But then, if the device are indeed not safe by default... are we talking about criminal charges here? Would it be fraud, or what is the name of the crime where you knowingly sell hazardous stuff to the public?
- mjevans 4y ago
  I suspect some faster-charging specifications rely on data frames over the non-power lines, and if none currently do new ones might.
  - falcolas 4y ago
    It does. Pretty much all charging modes above 5 watts requires some form of signal on a data line, if not outright negotiation. But that fallback to 5 watts is still valuable in a hostile environment (which is, sadly, everywhere these days).

by moring 4y ago

ChuckNorris89 4y ago

>building devices in a way that, of all things, charging them cannot hack them Affordability, convenience, security. Choose two. It's not patronizing, it's how the consumer electronics market works and how consumers vote with their wallet. Consumer device are sold with USB cables that pass data and power lines for cost and convenience, so they can also transfer data while also charging their device with the same cable that came in the box and not have them go out and buy another cable. Can you imagine being sold a phone who's cable only passed power lines and not data, "for your own security"? The consumer confusion and outrage would be massive. If your threat model seama it, the solution is buying a USB condom which only passe through the power lines, not the data ones. Just like the internet and TCP-IP, USB was designed from the start to be as cheap and convenient as possible, before anything else, to get market traction, which it did. Security concerns came much later.

moring 4y ago
I'd like to extend my thought experiment with professionals from all disciplines explaining why this is not patronizing at all and why it is exactly what consumers want.
antihipocrat 4y ago
Why can't the device being charged provide an option, such as charge only by default - and the user can turn on data transfer the same way we turn flight mode on and off?
- ChuckNorris89 4y ago
  Android allows that in settings. But AFAIK it's just a software setting, the data lines are still physically connected. The reason why there's no physical hard disconnect available in settings comes back to what I said earlier, cost and convenience from the manufactures' perspective. They don't want to spend 2 cents on some mosfets for HW disconnects, and they don't want to nag the user every time they plug in the phone to charge as that would hurt the UX. They want the device to sync up automagically to whatever device you're pugging it into. That's what USB was designed for, convenience. Plus, if you nag the user every single time they plug in the USB with a security prompt, they will just get desensitized and instinctively click 'YES' all the time.
  - olabyne 4y ago
    You also need to have the USB connected on boot, for update/flash purpose.
  - deleted 4y ago
    [deleted]
- rjh29 4y ago
  That is what my android phone does, I have to toggle it to allow data every time.
- NavinF 4y ago
  Funny you mention that when literally all flagship phones (both iOS and Android) have a "Do you trust this computer?" popup that does exactly what you described. By default, phones don't do any data transfer over USB.
  - iavael 4y ago
pengaru 4y ago
> Can you imagine being sold a phone who's cable only passed power lines and not data, "for your security"? The consumer confusion and outrage would be massive. I can imagine a phone sold with a readily accessible and highly visible physical toggle switch for power-only mode, giving consumers a discoverable built-in USB condom.
- ChuckNorris89 4y ago
  You can imagine it. But can you imagine Apple, the "everything works automagically that we don't even give you basic setting in the SW" company, actually selling something like that to consumers? It would be a heresy to everything they stand for in terms of UX and physical device design.
  - carlitossway 4y ago
    The toggle on and off switch would be very unApplely, yes. That does not mean you have to stop thinking, it means you need industrial designers on board. USB-condoms are a thing you know; average (and below) users know exactly what those do and can figure out how to use them in a few seconds. I bet if Apple's genius marketeers would come up with a catchy name (like the i-Safe, but cooler) those would easily sell at 3,000% the production cost. But they never will because they tarnish the brand, and make the users think their devices are not safe by default. But then, if the device are indeed not safe by default... are we talking about criminal charges here? Would it be fraud, or what is the name of the crime where you knowingly sell hazardous stuff to the public?
mjevans 4y ago
I suspect some faster-charging specifications rely on data frames over the non-power lines, and if none currently do new ones might.
- falcolas 4y ago
  It does. Pretty much all charging modes above 5 watts requires some form of signal on a data line, if not outright negotiation. But that fallback to 5 watts is still valuable in a hostile environment (which is, sadly, everywhere these days).