News for hackers. Stuff that matters.

A comment on The Google plasma globe affair of 2012.

Re:The Google plasma globe affair of 2012 by yjftsjthsd-h on Monday October 10, 2022 @01:28PM (#33154134)
> The solution proved to be simple: we "borrowed" the USB vendor and product ID sent by an Apple-made keyboard taken from a coworker's desk. Looking at the prototype plasma globe sitting in my "old projects" box, it seems that we picked 05ac:024f.

I'm a bit put out that that worked, although I'm struggling to think of a solution that doesn't involve going full-crypto (including a proper PKI to let vendors sign devices) on all USB devices. But if anyone can set any vendor+product ID, it's not really a useful security measure.

[ Parent | on HN ]
Re:The Google plasma globe affair of 2012 by jaywalk on Monday October 10, 2022 @01:34PM (#33154185)
You have to realize that it was never meant to be a security measure. It's only there to identify the device to the host system.
[ Parent | on HN ]
Re:The Google plasma globe affair of 2012 by anamexis on Monday October 10, 2022 @01:57PM (#33154444)
Indeed, and the Keyboard Setup Assistant was never meant to be a security measure, either.
[ Parent | on HN ]
Re:The Google plasma globe affair of 2012 by yjftsjthsd-h on Monday October 10, 2022 @02:06PM (#33154564)
Ah, that was a mistake on my part: I'd initially thought it was. Rereading that screenshot, it's clear that it's not a security measure, just trying to help the user set the keyboard up, in which context it makes sense.
[ Parent | on HN ]
Re:The Google plasma globe affair of 2012 by renewiltord on Monday October 10, 2022 @02:02PM (#33154507)
It's got the same functionality as an Accept-Encoding HTTP header. It's meant to provide some information to the far end so that it can drive better behaviour. You can "impersonate" a client that isn't compatible and get junk data and there's no cryptographic protection against that.
[ Parent | on HN ]