Hacker News Reader

Comment by codezero | Hacker News Reader

Jeez, I thought these auto opening usb things were isolated to Windows and only old versions. What’s the story with this on macOS?

View on HN

On all new and old versions of all major operative systems out there you'll be able to plug in any standard USB keyboard, and it'll start working automatically.

That's exactly what's happening there, but the "keyboard" is pre-programmed to enter keys presses automatically in a way that makes a website pop up.

Of course. That makes total sense.

It's a USB keyboard that opens types some commands to open a hard-coded website.

You can't really prevent that.

This is pretty much the way a Yubikey or other 2FA token works, no? The only difference being that it doesn't send the text until the sensor is covered.

It's one way a Yubikey can work: Yubikey one time password (OTP). The more common (I think? Newer and standardized at least) way (U2F) accesses the key over some other method that doesn't have it act like a keyboard. There are other operation modes for Yubikeys, but personally I only use U2F and the CCID (aka act like a smartcard) modes.

You could require confirmation before accepting a new input device. This could be done with out of band signaling (such as a button on the computer itself that you push to say “yes, I want to use this keyboard”) or you could do it by requiring the user to type in a secret (such as their login password, or even just a PIN displayed on the screen) to enable it for other uses.

I don’t know that people would accept this inconvenience, though.

> or you could do it by requiring the user to type in a secret

how would you accomplish this given that the normal situation is that you're plugging in a keyboard?

I think the implication is you can type on the plugged in keyboard, but the OS won't pass the input through unless the first thing typed is a secret.

This is somewhat similar to how bluetooth keyboards are enabled on macOS (or were the last time I connected one).

Precisely. You get some authorization box and your input only goes to that box. If you authorize, it then acts like a normal keyboard.

The problem is.. it's a feature.

All kinds of legitimate (well, this is legitimate too really, it's just weird) devices have similar behaviour, and in their cases it's what the user expects and wants.

Reply on news.ycombinator.com