3 ms·

It would be cool if they could put a chip inside the chargers and have the charger communicate over USB C whether it's authentic or not. Of course you could sti

It would be cool if they could put a chip inside the chargers and have the charger communicate over USB C whether it's authentic or not. Of course you could still use third party chargers that would lack this chip, but for people who like first party chargers or buying chargers from reputable brands (that would probably license this from Apple) it would be nice.

MereInterest 3y ago
Anything that can be communicated by an authentic charger could also be communicated by a counterfeit charger. You may have raised the cost of the scam (e.g. by requiring another chip), or delayed the start of a scam (e.g. until the inevitable leak of hardward signing keys), but at the end of the day you're trying to validate a device through a communication channel controlled by that very same device. It's the same problem as with the satirical "evil bit" proposal for IPv4 [0]: Someone who is scamming you has already shown no compunction against lying to you through social means, and will lie to you through technical means as well. [0] https://en.wikipedia.org/wiki/Evil_bit https://en.wikipedia.org/wiki/Evil_bit
- JCharante 3y ago
  Couldn’t the chip have a HSM that signs requests to authenticate that it’s authentic? Data is already exchanged during the USB charging handshake, this could just be one extra step. The key might leak, which is why you could have a new key everyday that’s signed by an intermediate key and these are internet connected devices (iphones and macbooks and ipads) that could easily download a key block-list for a kilobyte everyday. Additionally, if the device has already connected to a charger in the past but then the key gets revoked, it could continue to show it’s authentic across their devices connected to their iCloud account, much like how wifi passwords and airpods just sync across devices.
  - rcxdude 3y ago
    Solving the key-leaking issue is usually done by having a unique per-device key in the HSM, and having an online database that can be checked for authenticity. Then cloning a device requires pulling out an HSM, and if you do sucessfully pull the key off that it becomes suspicious that many different devices have the same key, and it can be blacklisted. This is what google uses (anticompetitively, in my mind) to force people to use geniune chromecasts.
    - JCharante 3y ago
      Oh that seems like a smart way to prevent against key cloning. This seems quiet sound, although we don't live in a perfect world so I doubt we'll see this come until something bad happens like consumers losing faith in online purchases not being fakes or infamous fires resulting from "unlicensed" chargers.
permo-w 3y ago
they did this with PS3 controllers and it just made it an inconvenience to charge your remote that any counterfeiters could bypass anyway like great so I can't charge from the wall unless I buy a sony-branded charger at a huge markup?
- JCharante 3y ago
  Well, it would be optional in my vision. Just a different icon to show authentic charging versus unverified charging.
  - permo-w 3y ago
    your vision is sounder then one true way to prevent counterfeiters from circumventing your verification would be to give each plug a unique code, then have the device send off to your manufacturer servers to check the unique code is valid, which the device then remembers. you'd also have to either permanently lock the plug to one device, or have some pretty invasive location data to ensure the codes were genuinely unique though. either way it requires network connectivity, servers, etc alternatively, you could have a long and complex call and response behaviour, perhaps dictated by a deterministic neural net. this would certainly be hard to counterfeit, but not impossible.

MereInterest 3y ago

Anything that can be communicated by an authentic charger could also be communicated by a counterfeit charger. You may have raised the cost of the scam (e.g. by requiring another chip), or delayed the start of a scam (e.g. until the inevitable leak of hardward signing keys), but at the end of the day you're trying to validate a device through a communication channel controlled by that very same device. It's the same problem as with the satirical "evil bit" proposal for IPv4 [0]: Someone who is scamming you has already shown no compunction against lying to you through social means, and will lie to you through technical means as well. [0] https://en.wikipedia.org/wiki/Evil_bit https://en.wikipedia.org/wiki/Evil_bit

JCharante 3y ago
Couldn’t the chip have a HSM that signs requests to authenticate that it’s authentic? Data is already exchanged during the USB charging handshake, this could just be one extra step. The key might leak, which is why you could have a new key everyday that’s signed by an intermediate key and these are internet connected devices (iphones and macbooks and ipads) that could easily download a key block-list for a kilobyte everyday. Additionally, if the device has already connected to a charger in the past but then the key gets revoked, it could continue to show it’s authentic across their devices connected to their iCloud account, much like how wifi passwords and airpods just sync across devices.
- rcxdude 3y ago
  Solving the key-leaking issue is usually done by having a unique per-device key in the HSM, and having an online database that can be checked for authenticity. Then cloning a device requires pulling out an HSM, and if you do sucessfully pull the key off that it becomes suspicious that many different devices have the same key, and it can be blacklisted. This is what google uses (anticompetitively, in my mind) to force people to use geniune chromecasts.
  - JCharante 3y ago
    Oh that seems like a smart way to prevent against key cloning. This seems quiet sound, although we don't live in a perfect world so I doubt we'll see this come until something bad happens like consumers losing faith in online purchases not being fakes or infamous fires resulting from "unlicensed" chargers.

permo-w 3y ago

they did this with PS3 controllers and it just made it an inconvenience to charge your remote that any counterfeiters could bypass anyway like great so I can't charge from the wall unless I buy a sony-branded charger at a huge markup?

JCharante 3y ago
Well, it would be optional in my vision. Just a different icon to show authentic charging versus unverified charging.
- permo-w 3y ago
  your vision is sounder then one true way to prevent counterfeiters from circumventing your verification would be to give each plug a unique code, then have the device send off to your manufacturer servers to check the unique code is valid, which the device then remembers. you'd also have to either permanently lock the plug to one device, or have some pretty invasive location data to ensure the codes were genuinely unique though. either way it requires network connectivity, servers, etc alternatively, you could have a long and complex call and response behaviour, perhaps dictated by a deterministic neural net. this would certainly be hard to counterfeit, but not impossible.