No one, not even the Secret Service, should randomly plug in a strange USB stick

Re:No one, not even the Secret Service, should randomly plug... by Terr_ on Monday April 08, 2019 @11:03PM (#19611400)

> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password

Probably easier/safer to display a random number on-screen and then ask the user to retype it into the device. I figure numbers are less likely to run into problems when the keyboard isn't US-standard QWERTY.

For more paranoia/portability, show the user a repeating rhythm-game and wait for them to hit any keys they want as long as it is close enough to the correct pattern. ("Shave and a haircut... two bits!")

You could also use audio output for the user to hear, but then the attacker could embed a tiny microphone in the USB stick...

[ Parent | on HN ]

Re:No one, not even the Secret Service, should randomly plug... by jpindar on Monday April 08, 2019 @11:25PM (#19611505)

Then in a walk-by attack the attacker can just type the number or play the game. Hopefully they wouldn't know the user's password.

[ Parent | on HN ]

Re:No one, not even the Secret Service, should randomly plug... by Terr_ on Thursday April 11, 2019 @04:46PM (#19639007)

Confirming a new device should always be separate from the dozens of unique and distinctive scenarios where a user might (or might not) need to authenticate themselves.

[ Parent | on HN ]

Re:No one, not even the Secret Service, should randomly plug... by jimrandomh on Tuesday April 09, 2019 @06:52PM (#19619772)

The reason for it to be the user's login password is that, in the common case where you plug a keyboard into a computer that's just booted or which has been unattended for awhile, you're already typing a login password, so it isn't making you do anything you weren't doing already.

[ Parent | on HN ]