News for hackers. Stuff that matters.
Re:USB Type-C to Become More Secure with Authentication Stan... by geofft on Wednesday January 02, 2019 @04:33PM (#18810458)
Don't we have technologies for that like fuses?

In particular, people seem to use untrusted AC power outlets all the time without their devices being fried. The motivations of an attacker who wants to fry devices (mere lulz) and the motivation of an attacker who wants to break into working devices silently are very different; it makes sense to expect more of the latter, and to define the latter and not the former as within your threat model.

Re:USB Type-C to Become More Secure with Authentication Stan... by cesarb on Wednesday January 02, 2019 @04:59PM (#18810672)
A fuse protects against overcurrent. It does nothing against overvoltage, or worse, reverse polarity (which was what fried Benson Leung's device). USB-C has a maximum of 20V, and that's only when negotiated by both devices; many devices will only expect 5V. If an untrusted low-quality power supply fails, it can put the full line voltage (alternating from -110V to 110V or more) into the USB cable. Protecting against that would add a lot of bulk and cost to a device. AC powered devices, on the other hand, already have to deal with the full line voltage (which includes negative voltages) all the time, so there's no extra cost for them.
Re:USB Type-C to Become More Secure with Authentication Stan... by justrobert on Wednesday January 02, 2019 @05:08PM (#18810762)
The solution I use and many others is to only charge a usb battery in public, and you use that battery to charge your devices.

That works well to solve all the issues with public power ports.

Re:USB Type-C to Become More Secure with Authentication Stan... by zzzcpan on Wednesday January 02, 2019 @05:02PM (#18810702)
Fuses and input protection in general can't save your device from a malicious attacker connecting say a powerful taser into a usb port.
Re:USB Type-C to Become More Secure with Authentication Stan... by geofft on Wednesday January 02, 2019 @05:15PM (#18810819)
I mean, they also can't solve a malicious attacker connecting a powerful taser above a USB port and trying to maim whoever uses the port. What's your threat model again?
Re:USB Type-C to Become More Secure with Authentication Stan... by zzzcpan on Wednesday January 02, 2019 @05:21PM (#18810883)
Obviously. I mean that you can't protect the device from malicious power and usb outlets. And for non-malicious things the device should already have input protection, otherwise it's unsafe to use if it doesn't when plugged in and unsafe leaving it plugged in unattended (you can die from electrocution or it can cause fire).