6 ms·

Honestly, I'm not surprised. Bluetooth is an unsecured microcontroller that does not run an open source firmware (and yes, I'm aware, the CVE is partially enabl

Honestly, I'm not surprised. Bluetooth is an unsecured microcontroller that does not run an open source firmware (and yes, I'm aware, the CVE is partially enabled by the software stack as well). By definition, that is a security nightmare. I don't generally use Bluetooth devices in my house. Between the security nightmare aspect and the fact that it's always a worse end user experience than just going wired (no dropped packets, no failure to pair after being paired fine for months, no batteries slowly dying and then becoming spicy pillows; just 100% pure glorious wire).

jeffbee 3y ago
For some reason Bluetooth has to be enabled for Android Auto to work, even though it's wired, so I leave it enabled. But there should be a way to just disable keyboards categorically, for phones.
- wtallis 3y ago
  Doesn't Android Auto carry audio over Bluetooth? That would be consistent with how unreliable the audio is.
  - jeffbee 3y ago
    I don't know. What's the wire for? Needing both the USB cable and Bluetooth has always struck me as pretty dumb.
    - pepelotas 3y ago
      The bluetooth connection is for phone calls. The rest of functionality works over the wire. As for the why does it need bluetooth at all, no idea.
      - TylerE 3y ago
        Needs to be bluetooth so the handsfree controls on the steering wheel work without an outrageous degree of coupling.
  - xp84 3y ago
    Hey don’t knock it until you’ve tried Apple’s equivalent (wireless CarPlay) which has a 3 second buffer since they decided to use Wi-Fi for audio. Imagine if every time you play or pause or change tracks you have to count to three in your head before it responds. Yes, I’m bitter. Somehow the video and touch are lag-free 1 but the audio is on a delay. I’d love to have regular Bluetooth audio be used.
    - kelnos 3y ago
      Wait, what? Wifi? Does that mean that a car that has CarPlay must also have Wifi that can act as an access point, and do some sort of automatic connection negotiation when the phone is plugged in and CarPlay is activated? That seems... terrible.
      - wtallis 3y ago
        Wireless CarPlay didn't show up until several years after the original USB-based CarPlay, which is still around and there may still be new vehicles on the market which only support the USB-based CarPlay. Wireless CarPlay starts with a Bluetooth connection which is then used to negotiate the higher-bandwidth WiFi link. Neither CarPlay nor Android Auto can operate on Bluetooth alone, because the video data that needs to be streamed far exceeds what Bluetooth can handle.
        MBCook 3y ago
        It’s a point to point link too, not standard access point style.
    - charcircuit 3y ago
      >since they decided to use Wi-Fi for audio Choosing to buffer for 3 seconds isn't the fault of wifi. There is no reason it couldn't start playing in a few milliseconds.
    - shzhdbi09gv8ioi 3y ago
      Your 3-sec delay issue sounds more like AirPlay 1 vs AirPlay 2 issue to me. AirPlay 1 has this delay (or more like 2 seconds to be fair), while it is reduced to like 200ms on AirPlay 2. shairport-sync runs on a raspberry AND supports airplay 2. You can hook it up to your car.
  - TylerE 3y ago
    If it's anything like CarPlay, it's absolutely NOT bluetooth.
lxgr 3y ago
As is the baseband, or the Wi-Fi chip, or most of the other components in a modern phone. Proper hardware isolation (e.g. using IOMMUs) should be able to mitigate many of the resulting problems – and if the OS can be compromised using the software driver stack, that is indeed a problem of the OS/driver.
bee_rider 3y ago
Wireless keyboard generally seem like a totally terrible idea, just waiting for hacks. The author mentions not going after wireless gaming keyboards because they were the “wrong kind of mess,” I assume, security through abstrusity :)
- kelnos 3y ago
  I never really understood the benefits of a wireless keyboard. Do people usually carry their keyboard from their desk with them when they take their laptop somewhere else? I guess I could maybe -- maybe -- see the convenience if you have some sort of small-form-factor keyboard that you stash in your bag. But still, the wire doesn't seem like much of a burden, and personally I'd find the annoyance of needing to ensure the batteries are charged/fresh to be... more annoying. I can kinda see how a wireless mouse would be nice; the wire can get in the way of mousing around sometimes. But I'd still rather a wired one than wireless.
  - aydyn 3y ago
    I don’t see how people can STILL use wired nowdays. It’s so much less desk clutter and vastly better aesthetics to go full wireless. Charging is not an issue, get some Logitech that lasts months if not years.
    - hexfish 3y ago
      Not everyone cares about the aesthetics of their tools or shares your sense of aesthetics (minimalism). Furthermore: OP and things like mousejack are exactly tbe reason why some people will not use a wireless input device. Keyboards are used to enter secrets so they rank pretty high in my threat model.
      - aydyn 3y ago
        That sounds a little paranoid, especially when you have options for factory paired keyboard/dongle encryption. And aesthetics? This is a forum that tirelessly obsesses over micro usb vs usb-c. Wired is de facto obsolete afaiac.

jeffbee 3y ago

For some reason Bluetooth has to be enabled for Android Auto to work, even though it's wired, so I leave it enabled. But there should be a way to just disable keyboards categorically, for phones.

wtallis 3y ago
Doesn't Android Auto carry audio over Bluetooth? That would be consistent with how unreliable the audio is.
- jeffbee 3y ago
  I don't know. What's the wire for? Needing both the USB cable and Bluetooth has always struck me as pretty dumb.
  - pepelotas 3y ago
    The bluetooth connection is for phone calls. The rest of functionality works over the wire. As for the why does it need bluetooth at all, no idea.
    - TylerE 3y ago
      Needs to be bluetooth so the handsfree controls on the steering wheel work without an outrageous degree of coupling.
- xp84 3y ago
  Hey don’t knock it until you’ve tried Apple’s equivalent (wireless CarPlay) which has a 3 second buffer since they decided to use Wi-Fi for audio. Imagine if every time you play or pause or change tracks you have to count to three in your head before it responds. Yes, I’m bitter. Somehow the video and touch are lag-free 1 but the audio is on a delay. I’d love to have regular Bluetooth audio be used.
  - kelnos 3y ago
    Wait, what? Wifi? Does that mean that a car that has CarPlay must also have Wifi that can act as an access point, and do some sort of automatic connection negotiation when the phone is plugged in and CarPlay is activated? That seems... terrible.
    - wtallis 3y ago
      Wireless CarPlay didn't show up until several years after the original USB-based CarPlay, which is still around and there may still be new vehicles on the market which only support the USB-based CarPlay. Wireless CarPlay starts with a Bluetooth connection which is then used to negotiate the higher-bandwidth WiFi link. Neither CarPlay nor Android Auto can operate on Bluetooth alone, because the video data that needs to be streamed far exceeds what Bluetooth can handle.
      - MBCook 3y ago
        It’s a point to point link too, not standard access point style.
  - charcircuit 3y ago
    >since they decided to use Wi-Fi for audio Choosing to buffer for 3 seconds isn't the fault of wifi. There is no reason it couldn't start playing in a few milliseconds.
  - shzhdbi09gv8ioi 3y ago
    Your 3-sec delay issue sounds more like AirPlay 1 vs AirPlay 2 issue to me. AirPlay 1 has this delay (or more like 2 seconds to be fair), while it is reduced to like 200ms on AirPlay 2. shairport-sync runs on a raspberry AND supports airplay 2. You can hook it up to your car.
- TylerE 3y ago
  If it's anything like CarPlay, it's absolutely NOT bluetooth.

lxgr 3y ago

As is the baseband, or the Wi-Fi chip, or most of the other components in a modern phone. Proper hardware isolation (e.g. using IOMMUs) should be able to mitigate many of the resulting problems – and if the OS can be compromised using the software driver stack, that is indeed a problem of the OS/driver.

bee_rider 3y ago

Wireless keyboard generally seem like a totally terrible idea, just waiting for hacks. The author mentions not going after wireless gaming keyboards because they were the “wrong kind of mess,” I assume, security through abstrusity :)

kelnos 3y ago
I never really understood the benefits of a wireless keyboard. Do people usually carry their keyboard from their desk with them when they take their laptop somewhere else? I guess I could maybe -- maybe -- see the convenience if you have some sort of small-form-factor keyboard that you stash in your bag. But still, the wire doesn't seem like much of a burden, and personally I'd find the annoyance of needing to ensure the batteries are charged/fresh to be... more annoying. I can kinda see how a wireless mouse would be nice; the wire can get in the way of mousing around sometimes. But I'd still rather a wired one than wireless.
- aydyn 3y ago
  I don’t see how people can STILL use wired nowdays. It’s so much less desk clutter and vastly better aesthetics to go full wireless. Charging is not an issue, get some Logitech that lasts months if not years.
  - hexfish 3y ago
    Not everyone cares about the aesthetics of their tools or shares your sense of aesthetics (minimalism). Furthermore: OP and things like mousejack are exactly tbe reason why some people will not use a wireless input device. Keyboards are used to enter secrets so they rank pretty high in my threat model.
    - aydyn 3y ago
      That sounds a little paranoid, especially when you have options for factory paired keyboard/dongle encryption. And aesthetics? This is a forum that tirelessly obsesses over micro usb vs usb-c. Wired is de facto obsolete afaiac.