USB 3.1 now has digital signatures: may force you to use vendor chargers only | Hacker News Reader

USB 3.1 now has digital signatures: may force you to use vendor chargers only

usb.org

63 pointscnvogel65 comments

"People of the same trade seldom meet together but the conversation ends in a conspiracy against the public, or in some contrivance to raise prices." - Adam Smith

"Just because you're paranoid, don't mean they're not after you" - Nirvana

I don't think this is going to solve the problems of poor quality chargers. Recalling the Google engineer testing large numbers of USB3.0 cables, his Chromebook was damaged because a bad cable reversed the wiring of the power and data lines. Just because your phone asks the charger for its signature doesn't mean it won't get max continuous voltage to its DATA_RETURN channel instead. This is an unnecessary complication that isn't going to solve any problems, just add new ones.

Con: you'll have to use vendor chargers.

Pro: you won't be able to use these:

http://www.righto.com/2016/03/counterfeit-macbook-charger-te...

or their moral equivalent

http://www.righto.com/2012/03/inside-cheap-phone-charger-and...

http://www.instructables.com/answers/240V-Power-Socket-with-...

http://www.gizmodo.com.au/2014/06/please-dont-buy-cheap-phon...

... it's not as simple as "big bad charger conspiracy" - scummy manufacturers really are putting out deathtraps out there, and a protocol protection to convince you not to keep using them makes sense.

Dude its Universal Serial Bus for a reason and this just defies this reason.

That the underlying bus is universal does not mean all device pairs must work (that already isn't the case).

Yes it means exactly that. Otherwise it fails as a user friendly connecting standard.

> Yes it means exactly that.

No, it does not now, and it never has at any point in the past.

> Universal Serial Bus

It's not Universal

It's not Serial

And it's not a Bus

gg Intel

just because you want a paid walled garden doesn't make it less of a business conspiracy.

it is what it is.

you're giving away freedom to buy a better brand than oem or to build your own, just to be protected against buying a cheap charger that you probably know before hand on price alone that it's counterfeit. pretty sure the funding father's had a saying for that situation...

It doesn't make sense to require authentication on chargers, because then either only a small elite group can make chargers and charge insane prices, or everyone can make a charger after licensing the authentication procedure and then we're back at square one.

It doesn't solve the problem, it moves the stupid somewhere else.

well, there is a growing problem around counterfeit chargers and there are good reasons to use (more expensive) original ones - see e.g.

https://news.ycombinator.com/item?id=11325150

So it makes sense to regulate chargers somehow. Not sure if this is the best solution, but if we can prevent the small elite group from charging insane prices, that could work.

well, there is a growing problem around counterfeit chargers and there are good reasons to use (more expensive) original ones - see e.g.

https://news.ycombinator.com/item?id=11325150

So it makes sense to regulate chargers somehow. Not sure if this is the best solution, but if we can prevent the small elite group from charging insane prices, that could work.

Not necessarily, the certification could involve testing, similar to how I believe wifi certification works.

If you have an authentication procedure, you can do things like force the manufacturer to put down a security deposit, do background checks on the applying company to make sure they have history, or force him to undergo some kind of standardized testing on the product. It doesn't help on a technical level, but helps on a social one.

Game consoles historically have done all of these: You have to spend tens of thousands on a developer kit, they often prefer to see companies with a history, and they review your game before they allow you to sell it. I think all of these do help increase the quality.

The negative of course is that you end up with a walled garden.

That means we'll get to see low or slow (or no!) rates of adoption, like with Thunderbolt.

Instead of getting cool, inexpensive eGPU or other external PCIe tech, we have to pay upwards of $200 just to connect our existing PCIe cards. And take note of the cost difference between external hard drives that incorporate Thunderbolt rather than USB3.0: they're way more expensive.

What's more convenient for consumers? USB3.0, not Thunderbolt. Even though Thunderbolt is way more interesting and has way more promise (it's the entire PCIe bus, exposed!), it was nearly stillborn because of its inane licensing.

I'd prefer rigorous licencing and somewhat expensive authentication to the current USB free for all where a £5 charger can destroy your £500 device.

If we end up replacing the current market where chargers run £1-£30 with one where they're £8-£35, but can be confident of reasonable levels of basic electrical functionality and safety, I'd be happy enough.

Good for you. Then you can go and buy the authenticated charger, and others can move on to something else.

My surge protector comes with a $10,000 mini-insurance policy if it fails to protect against a surge. It seems like something similar could be done for any market: Buy up 10,000 USB chargers for cheap, have them all inspected, underwrite an insurance policy that reimburses the customer for manufacturing defects, and charge more. Have a backup policy with a big insurance company for the sole purpose of assuring customers that they have someone to file a claim with in the event that you're bankrupt.

You don't even need a standards consortium to do it.

Well, define "Insane" - if we're talking an extra $5-$7 on a $20 charger, I, personally, am completely fine with that as long as it means I can rely that it will perform to spec, not damage my equipment, and provide full data rate performance. Particularly how important USB chargers are every single day of my life.

This is a much bigger deal with USB 3.1, as according to http://www.extremetech.com/computing/197145-reversible-usb-t..., we're looking at up to 100 watts of power being sent down the wire - I very, very, very much want to be certain that the gear I'm connecting to the charger doesn't get torched by the wrong power levels.

I think there is a reasonable middle ground between "Small Elite Group" and "Everyone" - I.E. given that the global market for USB chargers will be on the order of approx 1 Billion units/year (certainly more than 100 million, and probably less than 10 Billion) - and given that a 4-port charger goes for about $20 today, presuming the cost of those chargers goes to, say, $27, then that's $27 Billion revenue/year. (Some chargers will be single/dual port, but other chargers will be more expensive/featured - we're schwagging here). Probably sufficient to support on the order of 2-3 thousand companies that have been certified, presuming that each company needs to drive around 10mm revenue/year after certified their product(s).

I'm satisfied with being limited to 2000 or so USB charger vendors of hopefully higher quality, than 10,000+ of who-knows quality.

The problem is that there are other countries out there apart from UK, US, Germany and other rich western ones. Where I'm from(Poland) the minimum wage is about $2.60/hour at the moment. And it's not like Apple/Samsung/Sony/any other big manufacturer sell chargers cheaper just because we earn less. Original Apple USB charger costs about $30 here - that's more than a day of work for a lot of people. Those people are going to look for cheap USB chargers, even if they are sub standard quality - and the market will fill that niche one way or the other.

buying overpriced equipment (apple) while complaining that with low wage you really feel the difference of price for a freakin' charger doesn't make much sense.

In this case, the Apple charger is the only one you'll be able to get, because USB3.1 is restricting the group of people that can make chargers.

That or the licensing will make it prohibitively expensive no matter what. Pick your poison, I suppose.

Seriously, the tech situation in Poland is really sad. We don't need USB3.1 making it worse. (I'm a citizen)

It doesn't make sense to complain that an accessory you can buy for $5 will now cost $30 because your phone is expensive? How does that line of reasoning even follow?

This is literally the same as saying "I won't be able to afford higher cigarette prices" "well don't get an expensive phone then".

I lived in a country where $10 was a normal day wage. Lots and lots of iPhones there. It is a choice, THEIR choice. It is not up to you (or me) to be snobby and tell them not to buy expensive products because they don't earn enough money to do so.

When the charger that comes with the product breaks they'll need another one. If they can buy a cheap one that "just works" then yes that will make a difference. Even if the cheap one isn't certified. Not all of them are the horrific death traps that have been highlighted.

If I'm making very little money, and I have equipment that requires a USB 3.1 charger, then it is even more important that my (expensive) equipment is not damaged - then, instead of being out an extra $7 for a charger, I've potentially lost many hundreds of dollars damaged by a out-of-spec charger/cable.

This is a very real problem: http://arstechnica.com/gadgets/2016/02/google-engineer-finds...

This wasn't that big of a deal in the Pre 3.1 era, because the power levels typically being supplied were less, and there was a broad understanding of the power levels that were going to be supplied.

You write, "Those people are going to look for cheap USB chargers, even if they are sub standard quality - and the market will fill that niche one way or the other." - and I totally agree with you, which is the entire reason why these certification programs are required - to ensure that only systems certified to be in-spec will be recognized.

My 10 Watt USB charger, that I've carried with me all over the world for 2+ years, powers up my iPhone, my iPad, and my battery-backups. I use it every single day, usually multiple times/day. I realize that an extra $7 can be a lot of money for some people, but, spread over 2 years, for something so important, it seems to be a reasonable investment.

It becomes an even bigger deal once you can also charge your laptop off the same charger.

If they actually cared about energy quality and equipment protection, they would check and protect on electric criteria at the plug, not add an electronic signature.

I don't know which, "they" you are referring to here - the end customer, the standards body, the charger manufacturer, or the manufacturer of the equipment being charged?

The customer quite often just wants the cheapest price, the charger manufacturer doesn't care about anything other than selling lots of chargers, the two groups that do care, the Standard Body, and the manufacturers of the equipment being charged do care about energy quality and equipment protection. In the case of the manufacturer of the equipment being charged - you are right, they can take steps to protect their equipment, but it costs a bit of money to engineer a subsystem to detect a 100 watt charge and protect the upstream gear - likely cheaper just to query and confirm that the downstream device is certified and then trust it (somewhat). You still need the protection (defense in depth) - but starting off with certified chargers certainly helps. The standards body, really has every incentive to ensure that the only certified vendors can manufacture chargers that will be (broadly) accepted.

i'd gladly pay a bit more for a charger that does it all, except i want to not have a charger at all - i want a usb port in my AC socket. the best part about it is that i've already got some. i want them to keep working, as right now i don't need a charger sticking out of the socket at all and would like to keep it this way.

Maybe I'm just used to living in older houses, but doesn't the thought of having your expensive phone plugged into the grid, without surge suppression, fill you with dread?

Is it really a problem though?

As you said, the market will fill the niche either way.

This extra effort is not going to effect people who can only buy the cheapest chargers. They will buy the knock offs as they have always done.

The rest of us can now be certain that our chargers are within spec.

If they are certified I don't think that would happen.

What’s sad is that even when the designers consider proper isolation, shoddy manufacturing and components can quickly undo their efforts, causing a short that leads to injury to devices and humans.

Con: I can't use a charger I made on my own.

But you won't be able to use good chargers interchangeably. If you travel with two phones of different brands, you'll need to bring both chargers as well.

We don't know that yet, they could just hand out keys with a PKI handled by a third party, once the device and manufacturing process are validated.

But: it will cost money, and someone will have to foot the bill. USB is one of the most open and universal standards out there, and it is sad that is has come to this, since it could be needed for safety (the amount of power it manages is no longer negligible).

> ... it's not as simple as "big bad charger conspiracy" - scummy manufacturers really are putting out deathtraps out there, and a protocol protection to convince you not to keep using them makes sense.

Isn't this what trademark law is all about? Buy from a reputable manufacturer.

I also seem to remember something about consumer protection laws, so maybe the people who make the things that catch on fire should be bankrupt or in jail.

It's not like this is the first time anything like this has ever happened.

> I also seem to remember something about consumer protection laws, so maybe the people who make the things that catch on fire should be bankrupt or in jail.

People who make (or sell) those things might be in a completely different jurisdiction that is not bound by your consumer protection laws.

Which could put the liability on the people who are importing/selling them.

Or, if it's literally end customers buying directly from foreign countries, caveat emptor and you should buy from somebody in a country with functioning consumer protection laws, in much the same as it is if you travel to abroad and bring some lead paint choking fire hazard back with you.

That's what I also thought. Then I wanted to order Apple Earpods from Amazon.de and decided that it's impossible. If something is more or less easily fakeable and enough of it is sold, then there will be fakes out there and it will find its way to the customer through normal retail.

The problem actually seems to be that it will find its way to the customer through Amazon. Are they selling Apple-branded fake ones at Walmart?

I ordered one of these $2 USB 3 Type-C to USB 3 Type-A cables from eBay so I could transfer files from my Nexus 5X to my MacBook. Since these stories started popping up I just placed it in a drawer.

It has no wall socket adapter and I wonder if it's safe to use for the phone if I just connect it to the computer. Seems the computer USB port shouldn't be able to feed enough power to hurt the phone. True?

In this case, the problem is not how much power the computer "feeds" to the phone, the problem is how much amperage the phone draws from the computer. The bad Type-C cable can be incorrectly configured to indicate to the phone that the Type-A computer end can provide more amps than it actually can, and then the phone will provide less effective resistance across the 5v power wires than is appropriate. In this case it's more likely to damage the USB port on the computer.

It's also theoretically possible that this cheap cable could be wired very wrong and short some power wires itself. But there was, like, only one cable people have found on amazon that was that ridiculous ...

False, possibly:

https://www.amazon.com/review/R2XDBFUD9CTN2R/ref=cm_cr_rdp_p...

IIRC its the other way round: your phone will not realize it is actually being plugged into a USB Type-A port, which might not be able to (safely) supply the current a USB 3 Type-C port potentially would allow. This is done by terminating a certain pin of the cable with a respective resistor, while USB Type A has no such pin and such a cable must thus by default terminate to 56kOhm.

If now the cable does _not_ terminate, the phone might think it can draw way more power than the PCs slot can safely deliver, thus frying your PC port. The phone is not the problem.

I think if I were using Linux I'd prefer an option I can specify in modprobe.d to disable signature verification for the kernel module handling this (at my discretion).

Or would this be at like layer 7? :>

But then I can't use Anker's chargers either? Anker has done me the good that most alternatives fail to accomplish for me. Also what about those lovely portable chargers? All useless now? :)

However it won't stop bad chargers from pumping 220v and full outlet amperage over the USB, and completely frying your device anyways.

> Con: you'll have to use vendor chargers. > > Pro: you won't be able to use these:

The con (which is really a con) represents a restriction to your freedom of choice and, ultimately, the creation of a monopoly.

The pro, on the other hand, is irrelevant. If you wish to risk your gear connecting crap components to it, feel free to do so.

What I want is the ability to actually buy and use a component without being strong-armed by the manufacturer to comply with their price-gouging. If risking having to brick the product I bought with my own cash if I intentionally purchase crap chinese knock-offs then that is the price to pay, and a price that I'm willing to pay.

At least in Europe they recently passed a law about charger reuseability. I'm sure companies will at least see some pushback, because a vendor charger only is exactly what they tried to stop.

I hope so. It would be annoying to carry different chargers for all gear I carry.

Even if it's implemented, charging from laptops, etc. is very unlikely to be removed. And that means there will be software-only solution to authenticate. Which means the right code will be dumped... Just give it time.

I fear that this spec may be a way to circumvent the EU charger rules, e.g. the rules only specify the physical properties, but don't have a say whether the device may deny the charging.

Bad business practice anyway, and I will probably use it only to cross out devices from the purchase lists.

Maybe, but I hope that the law makers will see this as a the move it would be and rectify the bill such that all vendors are required to publish certificates for 3rd party use.

yeah, i've got wall sockets with usb ports (yay ikea) and if these stop working, i'll be seriously pissed.

But... this was already possible. You could easily design a circuit+chip which will authenticate to your charger and only pass the current to the battery if it worked. A way to do it has been standardised, but it's not like some great barrier has been lifted.

Yeah this is exactly how I feel. This was already possible and it's not like companies aren't doing it. Apple is the most notable offender, every iPhone Lightning cable sold comes with a security chip; if the chip's not there, the phone won't charge. Normally this would be a problem for counterfeit cable sellers, but Chinese manufacturers have reverse engineered the chip hence customers don't notice a problem.

http://www.cultofmac.com/246236/ios-7-killed-off-unlicensed-...

It's been fine up to USB 3.0, there were no major problem with electrical surges because they use fairly low voltage. It's USB3.1 power limit that's the problem. And it speaks more about the USB-IF's carelessness when drafting its specification for USB3.1 more than anything. They should've taken misuse of over voltage into consideration before releasing it to the manufacturers.

A digital signature is reasonable if it can be used to produce a warning but not a denial.

In other words, if my computer wants to pop up a “This will void your warranty!” warning the first time I plug in a cheap peripheral that has not been validated, I think that is fair use and buyers are free to continue and accept any consequences. On the other hand, I do not think the original manufacturer has the right to outright prevent the use of unsigned-but-standards-compliant devices, since that wanders into “you actually leased and never owned your device” territory.

What's the point of creating a standard if you're going to enforce vendor specific afterwards?

Wasn't the standard on favor of less garbage after all? I mean, if all my gadgets would use the same connector, maybe vendors could start shipping products without a bundled one?

Why would that require you to use vendor chargers only?

Surely it depends how the digital signature is used. At best, it simply gives you a way of authenticating that the device that you have just plugged into your USB port is actually what you think it is (huh? It's meant to be a memory stick, not a keyboard?!) before giving it system access.

I don't think it's gonna be all that bad. It will be based on certificates so if you are able to control which certificates are accepted you can have pretty fine control.

That's kind of how I understood it. In their press release they talked about "compliance to the standard", which I don't think is the same with "smartphone vendor-only". And I think the user can modify this control somehow from the devices themselves.

http://www.businesswire.com/news/home/20160412005983/en/USB-...

Bye bye USB!

Universal parallel bus! With cables that don't turn to wire straw after six months. (I just spent $50 renewing all the crappy cables for inexplicable multitude of screens we now apparently own.)

Reply on news.ycombinator.com