Hacker News Reader

prng2021

Guessing here but maybe it's supposed to be a security measure. What if you're in an office or public space and you have a hub or dock connected. A malicious actor could plug in an unknown device while you step away from the machine.

I also have Logitech peripherals that connect wirelessly to a USB receiver. I wouldn't want my receiver and machine accepting a connection from an unknown device.

View on HN

Also the device you plugged in might not be what you thought it was: not just in the “why did this weird dude in the parking garage give me a free USB key?” sense but because these devices have firmware which can be attacked so it could be something like a shared device which was compromised by a person you trust & like 99.99% of people your threat model didn’t extend to not letting them charge their phone / camera / e-reader / etc. on your laptop.

Obviously the better solutions here will involve things line better authentication at the protocol level but the compatibility challenge is enormous with decades of USB showing up everywhere.

Having some kind of device key that will trigger a pop up similar to the SSH host verification on the first connection would be better. No spam every time I connect the phone to charge it and getting a dialog for MITM attempts.

That’s what Ventura does…

Reply on news.ycombinator.com