Hacker News Reader

Comment by RedShift1 | Hacker News Reader

To me the idea of having to allow devices to connect is completely wrong. I have already undertaken a physical action to connect a device, why would I suddenly change my mind afterwards? The physical act itself IS the permission. What does it help when the OS asks you "are you sure"?

View on HN

This thread clearly shows that even in 2023 people still don't understand USB attack vectors and still think this is some evil move by Apple to degrade the user experience

I understand what's going on but how does asking the user for permission help? They're just going to click accept, ok, whatever to continue working. I doubt the user will even understand what's going on.

> Leaves laptop on desk, goes to bathroom.

> Bad actor plugs in device.

Pwned. This is why asking to allow works as a security measure.

In that case the machine would be locked and no new USB connections should be accepted in locked state?

And if the computer isn't locked during your bathroom break, the "bad actor" can do whatever he wants anyway, including clicking the Ok button after inserting the USB device.

But in general, yeah, an USB popup is the least of Ventura's problems (the much bigger problem is the slow but steady "iOS-ification" of macOS).

> In that case the machine would be locked and no new USB connections should be accepted in locked state?

Until you get back and unlock the device. Or if you have a usb hub it is possible for someone to plug something in without your knowledge while using the device.

> Until you get back and unlock the device

then show the popup at unlock! still doesn't explain the usefulness of the original popup

Isn’t that.. exactly what it being complained about?

The popup still appears even if the computer was unlocked the entire time.

It's not hard for a device to reenumerate with a different device descriptor. With Ventura that needs confirmation, which is probably the right response.

I assume the improved USB security is a) response to actual attacks (which Apple understandably doesn't want to publicize), b) fulfilling every more rigorous corporate and government criteria, or c) both.

I'm fine with it. Every thing Apple does to postpone my eventual pwning suits me just fine.

Just turn your computer off. Pwning is thus postponed indefinitely.

...oh, you wanted to get work done too? Well, now we have to compromise some things.

Guessing here but maybe it's supposed to be a security measure. What if you're in an office or public space and you have a hub or dock connected. A malicious actor could plug in an unknown device while you step away from the machine.

I also have Logitech peripherals that connect wirelessly to a USB receiver. I wouldn't want my receiver and machine accepting a connection from an unknown device.

Having some kind of device key that will trigger a pop up similar to the SSH host verification on the first connection would be better. No spam every time I connect the phone to charge it and getting a dialog for MITM attempts.

That’s what Ventura does…

Also the device you plugged in might not be what you thought it was: not just in the “why did this weird dude in the parking garage give me a free USB key?” sense but because these devices have firmware which can be attacked so it could be something like a shared device which was compromised by a person you trust & like 99.99% of people your threat model didn’t extend to not letting them charge their phone / camera / e-reader / etc. on your laptop.

Obviously the better solutions here will involve things line better authentication at the protocol level but the compatibility challenge is enormous with decades of USB showing up everywhere.

Given the number of devices today that use USB power, I don't think you can assume connecting a device physically means you also want data transfer. For example, I often bring my personal tablet to work so that I don't mix personal stuff onto my business computer. As a result I frequently plug it into the work machine to charge it, so I welcome the fact that I can tell my work computer "no I don't want any data transfers between this device which I intentionally plugged in and the computer"

I do worry about the fact that warning fatigue is a thing but so far I only seem to get the dialog on first connection and after an OS update which seems an ok compromise to me.

Presumably it would alert you that you've been tricked into plugging in a BadUSB or USB Rubber Ducky type device.

But... I'm skeptical it's more than a speedbump. I'm not super familiar with USB but all it might take for a BadUSB/Ducky to get past that is to just provide cloned device ids.

see the links acdha posted for what it's supposed to protect against - devices that are not the devices you think they are.

I see the links. They explain nothing - the user will just accept this useless prompt and will not notice the unnoticeable "when you least expected it, typed in a malicious payload right under your nose, ideally quickly enough for you to not even notice."

Reply on news.ycombinator.com