Around here a lot of places don't allow USB drives, but .. I think that's mostly a "Do Not Steal Our Data" policy.
Not, my real question is: Does that make sense? People talk about USB HID things, but .. I would expect that most keyboards and mice these days are using USB. So if you find a way to block USB drives for mass storage aka "Do Not Steal Data" uses, are you still open for all the "I type in exploits because I'm not really a USB drive, I can be a keyboard too" things?
Say you're in a "secure" place, where I'm not allowed to do stuff. You probably have keyboard/mouse connected via USB, right?
I can easily unplug them and insert my own, if you don't glue them in place. I did that in a number of internet cafes in the past.
Correct. If you're doing it right, you've blocked all unused ports, and you've glued in all used ports. Ideally having testing that the devices you're plugging in aren't already compromised first.
USB device fails and needs replacing? One place I worked disposed of the whole unit and bought a new computer to replace it, rather than dealing with glue removal. It's difficult to distinguish between legit and illegit tampering, so better to have no signs of tampering.
>I can easily unplug them and insert my own [keyboard/mouse]
Can you see where the problem lies? For you to be able to insert your own kb/mouse, you'd need to bring it from home in the first place. And while it might work if you're at an Internet cafe which isn't super strictly controlled, in an office with more stringent security requirements and checks you'd at least raise some eyebrows.
My subthread started as a reply to "Want to transfer files between computers? Can't use a thumb drive" and I wondered if that on its own - disallowing data transfers by say blocking USB mass storage device drivers or something - is useful or enough, when anything I can connect via USB can _act_ as a keyboard for example.
At no point did I talk about bringing an actual keyboard or mouse anywhere.