Hacker News Reader

Comment by on_and_off | Hacker News Reader

>We found that in some cases the "charge-only" USB mode may also fail to block AT commands.

wow that is embarrassing. This needs to be added to CTS like 5 years ago ..

You can never trust software to block data flows. There is no such thing as "charge-only" as long as the cable still has data wires in it.

> We found that in some cases the "charge-only" USB mode may also fail to block AT commands.

This is a good point. I wonder if there's a market for "power-only" USB cables without data? Or would those fail to negotiate the right wattage?

USB-C has separate lines for the "Configuration Channel", that is used to negotiate voltage and amperage. I'm unaware if the specification allows for cables without data lines, but I don't believe they would be required.

It would only work on USB-C host devices as well though, USB-A would still revert to either 500mA as long as the data lines are tied with a resistor

There's the USB Condom:

https://int3.cc/products/usbcondoms

http://syncstop.com/

While not at guaranteed, killing the data wires (or shorting them) makes the device think it is dealing with a charge only port.

Thus various companies have made devices that conditionally apply said short.

Here is one example: https://www.startech.com/Cables/USB-2.0/USB-Adapters/USB-2-F...

The USB condom is more for situations where you are in public and wish to charge your device from an unknown and possibly hostile USB-A receptacle.

That Startech device still isolates the data line, it just has the added bonus of adding fast charging support. It'd be effective as a "USB condom" alternative.

I have several cables like this. It's always briefly mystifying when I accidentally grab one to sync some data. No negotiation, my fancy devices just charge at 500mA using these cables.

This allows KDE/modemmanager to unlock the SIM card of my phone by just plugging it in though. I like it. I know my phone isn't top-notch on security but thankfully I know it isn't and take precautions outside.

Yep, when using an untrusted USB power source, you can use what is called a "USB condom": either an adapter or a USB cable with the data wires cut letting only power go through. You can search the web for tutorial on which wires to cut in your USB cable, or for already made USB condoms to buy for less than $10 a piece.

You need to buy good ones otherwise the power negotiation doesn't happen and you get a slow charge.

Any way to sandbox or proxy the power negotiation through the sheath? Laptop's USB controller chip could be vulnerable.

Not sure of any that do that, but I've seen quite a few that support most of the charging standards and negotiate the highest current available (still at 5V) so that the phone can usually charge reasonably fast.

There are chips you can buy that do power negotiation. You could design your own PCB that does the job.

> when using an untrusted USB power source...

Don't do that. Ever. Always use your own charger and cable, preferably the ones that came with the phone. If not make sure you're sourcing them from a reputable company and not an anonymous Chinese importer.

Reply on news.ycombinator.com