How will you prevent a USB device to present itself as both a keyboard and mass storage and then type commands that copy data?
For more safety: any plugged usb device should lock your screen so that a password is required before it can be used.
My point is that given how universal USB as long as a device can do both input and output it's going to be very hard to stop some exfiltration from being possible.
Do you really think a bug report should be filed on all OS's for allowing USB drives and keyboards to be plugged on a running system?
It is.
> Do you really think a bug report should be filed on all OS's for allowing USB drives and keyboards to be plugged on a running system?
Automatically trusting input devices is as bad as trusting user input. It's trivial to pass off a programmable USB keyboard as a mass storage device.
Convoluted way to put it I guess. For some reason was intuitive to me (proof of existence by example, more trivial example better).
Having access controls on USB-HID is just a local policy choice where most people would choose convenience over security.
But the comment I replied to seemed to suggest that the possibility of data exfiltration via USB is a bug in any OS.