Hacker News Reader

Comment by Animats | Hacker News Reader

“Your phone died, you’re gonna get in the car, plug it in, and there’s going to be this nice convenient USB port for you. When you plug it into this USB port, it’s going to charge your phone, absolutely. And as soon as it powers up, it’s going to start sucking all your data down into the car.”

That used to be just something seen in hostile devices. Now it's standard equipment.

View on HN

You can get a USB Condom [1] for this purpose.

[1] - https://www.amazon.com/PortaPow-3rd-Gen-Data-Blocker/dp/B06X...

Thank you, I just bought two! But any idea for if you're connected via Bluetooth?

Probably not without controlling one side of the communication. On the cell phone, you would need something that enforces mandatory access controls on what data can be sent over Bluetooth. Ideally a smart phone hacker could chime in. I've never owned one. Another potential option would be to root the car, likely voiding any warranty and potentially creating other liability implications.

You have to ok sharing contacts with "normal" bluetooth pairing. For a personal vehicle most people would.

Bluetooth is always switched off on my phone unless I am in a situation where I explicitly want to connect to something (this has not happened yet). General good advice is to go through you phone settings and turn off everything you know you don't need. If you don't know, turn it off and see if anything you need stops working.

Buying a USB Condom for a piece of equipment you own is absolutely ridiculous and unacceptable.

This is like having sex with your wife through a condom because you're worried about STDs.

I absolutely agree, one should not have to do this.

I'm not sure this disease metaphor is appropriate. Lots of people have STDs, and lots of those people get married, and, as I understand it, many of those people have a lot of safe sex.

And frankly, I don't trust many of my own devices not to fuck me. (figuratively speaking)

Do you really even own it, if it can be remotely disabled by the manufacturer?

Nowadays I mostly feed the e-herd with cables like these:

https://www.aliexpress.com/item/4001139641708.html

https://www.aliexpress.com/item/1005001524934944.html

A small plug stays with the device that moves about, the cables stay put with the charger, "mag-safe" for all the things ...

How effective is this today? Don't modern phones refuse to do anything except charge over a USB connection until the user unlocks the phone and trusts the connected host?

Yes, but we are back at square one, where if I want to use "Chevy Play" or whatever their music player is, I have to battle a legion of dark patterns reaching for my data i.e "Allow this Stop Watch app to not don't allow prohibit from reading contacts"

How I miss the ol standby Aux port with a 1/8" cable.

You can use CarPlay or Android Auto and the data isn't going anywhere new.

I was going to ask this. My iPhone will charge but won't talk to my computer unless I type my PIN and confirm a trust dialog. Don't these cars work the same way?

Or is this an Android/BlindlyHittingYes situation?

It's not an Android situation. Android makes you do the same thing.

Note 8 here, my phone will not communicate with the computer that I am plugged to unless I give it permission. It been like that since years ago.

Educated guess is that it is generally people blindly hitting yes situation. Often people just want to quickly setting it up and ready to be used. They don't want to wait 30 sec or more to look through the dialogs. They want instant results, that what they get for blindly hitting yes. In my experience, most of my friends and family are impatient when it come to pairing the phone to the head console.

Maybe those of us that understand this problem can and should help friends and family buy making/buying them a "USB condom"[1] and strongly encouraging that they use it anytime they want to plug something into USB for charging. This type of device can be as simple and cheap as a USB connector/cable with the data wires cut.

[1] A USB dongle that only passed the power pins through for charging. Data is either blocked or physically disconnected.

Doesn't work for all the higher-power USB-C charging options that require negotiation before the higher voltage turns on.

There are "smart" ones that MITM the power negotiation. IE they negotiate with the Devices for a particular PD profile, and with the Host for the same PD profile.

This is why I use a 12V-to-5V USB charging adapter in my 2019 model year car that absolutely has usb ports and supports android auto / carplay. I have connected it with bluetooth but only for calls and audio, no contacts / call history / etc. I trust apple enough to not screw that last part up and let my car get my contacts.

I'd still call it hostile though...

I started bringing and charging off those little external battery backup on trips years ago. Not perfect but great in hostile environments.. which is more and more.

> That used to be just something seen in hostile devices. Now it's standard equipment.

Remember when going around mapping wifi access points to location was "wardriving"? Well, then it became a business model. Although google was slapped on the wrist for doing it with their google maps cars early on, now all smartphones apple and google populate the database.

Reply on news.ycombinator.com