We X-Rayed a Suspicious FTDI USB Cable

Re:We X-Rayed a Suspicious FTDI USB Cable by fc417fc802 on Sunday January 25, 2026 @08:15AM (#46753843)

Me managing my own (for example) secure boot keys does not inherently enable malicious actors. Obviously unauthorized access to the keys is an attack vector that whoever holds them needs to account for. Obviously it's not risk free. There's always the potential that a user could mismanage his keys.

There's absolutely no excuse for hardware vendors not to provide end users the choice.

> trust is protected by trusted companies...

The less control of and visibility into their product you have the less trustworthy they are.

[ Parent | on HN ]

Re:We X-Rayed a Suspicious FTDI USB Cable by kachapopopow on Sunday January 25, 2026 @12:17PM (#46755914)

the hardware is made by asus, asus signs with their key backed by a trusted company.

asus gives out keys to sign bios firmware, now aliexpress can not only counterfeit, but provide tampered hardware.

you can enroll your own secure boot keys so that's not really relevant.

[ Parent | on HN ]

Re:We X-Rayed a Suspicious FTDI USB Cable by fc417fc802 on Sunday January 25, 2026 @01:13PM (#46756504)

Secureboot was being used as an example to illustrate the issue with your claim that a user controlling the keys must necessarily undermine security.

I'll grant that if the user is given control then compromise within the supply chain does become possible. However the same hypothetical malicious aliexpress vendor could also enroll a custom secure boot key, install "definitely totally legit windows", and unless the user inspects he might well never realize the deception. Or the supply chain could embed a keylogger. Or ...

[ Parent | on HN ]

Re:We X-Rayed a Suspicious FTDI USB Cable by kachapopopow on Sunday January 25, 2026 @03:00PM (#46757606)

you don't have to trust software, but you have to trust your firmware and hardware.

[ Parent | on HN ]