4 ms·
I wondered the same thing recently. I'm pretty sure you have to explicitly trust any new device that's plugged in on both Android and iOS now. Isn't this kind o
by nilespotter 4y ago
I wondered the same thing recently. I'm pretty sure you have to explicitly trust any new device that's plugged in on both Android and iOS now. Isn't this kind of solved?
- Bjartr 4y agoI've never been asked to authorize a charger I've plugged in. Plus, that assumes no exploits against the could be used that circumvent that system.
- mr_mitm 4y agoChargers don't have to be authorized. Chargers that pretend to be a computer do.
- cyberbanjo 4y agoBut do chargers that pretend to be keyboards, and other HID (Human Interface Devices) have to be authorized?
- mr_mitm 4y agoNo, but the impact of that on Android and iOS (which this sub thread is about) is quite limited.
- ratg13 4y agoThe person you are responding to is saying authorization isn’t always needed if they are exploiting a vulnerability. The fact that you allow a data connection may be enough to zero-click you. It’s like putting your computer on the internet and opening ports. You might think you are fine if you are up-to-date, but the reality is we don’t know about all of the current vulnerabilities and potential buffer overflows until much later.
- mr_mitm 4y agoThe person I responded to appeared to be confused that they never had to authorize a charger; I explained why that would be to be expected. If what you said is indeed what they meant, then I'd respond that warning the general public of airport charging stations that have been tampered with by some powerful organization potentially burning 0days on randos is a tad overblown.