Hacker News Reader

Comment by ceejayoz | Hacker News Reader

"Hey, stranger! Here's my card. Plug it into your computer's USB slot."

Cool project, but as a business card, making someone think they're about to install Stuxnet might not be the best first impression. Heh.

View on HN

Disappointed seeing a negative comment at the top.

This is a COOL project: BADASS even. You’re not technically wrong, but the world advances much more via optimism than pessimism.

To the creator: Rock On Dude. So so so cool.

I agree it's cool; that's why I prefaced everything with "Cool project".

> the world advances much more via optimism than pessimism

I don't think that's a slogan infosec folks frequently adopt.

Infosec folks should live a little. You can have more than one computer and not everyone is a head of state.

It’s all fun and games until your wife’s nudes or your most private messages are leaked.

The world would be a much better place if we all agreed everyone’s naked under their clothes and it’s no big deal.

Oh and most grownups have consensual sex occasionally. Shocker!

And they drink too :O

Sometimes even break minor laws!!

> everyone’s naked under their clothes and it’s no big deal

Until the day you render human biological urges inconsequential to the one experiencing them, all that phrase adds up to is the kind of line a teenage boy uses to get his girlfriend's clothes off.

Human nature is not infinitely malleable. A video of a woman sucking a dick becoming public will always be humiliating to almost everyone.

I can think of vastly more humiliating things, like a video of a woman spreading antivax or pro-choice propaganda. And, differently from a blowjob, which is just a religiously motivated prejudice, those acts are actually harmful and evil.

Not in the context of this project:

Please don't dismiss this so easily. You don't need to be the head of anything to take security seriously. Regardless of who you are or what you do, everybody has secrets they should protect.

And I mean secrets not only in the "human" sense (what you like/dislike), but also technical (credentials and so on).

Losing say, your bank account because you plugged in a USB can be devastating no matter who you are.

Thank goodness that bank accounts are heavily regulated and something like that is really hard in this era with AML efforts!

Cryptocurrencies on the other hand...

That's a very unrealistic view of how that works. If you plug a USB into your computer and your computer is compromised, the next time you log into bank account your cookies are snagged and they do something with your money.

If it’s that easy to do, why do I get spam emails and texts with broken English? Seriously the earlier comment was accurate, if you feel the need to comment on the security of this obviously not nefarious project change fields, you don’t have the stomach for infosec.

If you wanted to do something nefarious, using a medium that has your contact details printed on it seems unwise.

We all have a line. You may not plug things into your USB ports, some people don't even connect to the internet.

Either way, if I have a secret I'm sure as hell not going to write it down, let alone put evidence of it on a computer. Defraud my bank if you want, that's between you and them and honestly they can afford it.

If you wanted to do something nefarious, using a medium that has your contact details printed on it seems unwise.

Then put someone else's contact details on it "Hey man, I just found this 'linux business card' with Linus Torvald's contact information on it -- plug it in and try it!"

I'd notice it isn't Linus handing me his business card. The author is handing this to people in person. I wouldn't use it if he was wearing a ski mask. If you are already there, showing your face, commiting crimes, just use a gun to get whatever you want and skip the cloak and dagger stuff.

I have enough faith in my own abilities to evaluate if the dude I'm talking to is a scumbag or not.

Only heads of state are targets of black hat hackers?

The proliferation of virus scanners, firewall products and spam filters either means we have a lot of heads of state or a lot of people rich enough to own several computers and not give a damn about at least one of them.

Or the risk assessment is wrong, of course.

One can be impressed by the effort and ingenuity (I am) and still question the premise. Business cards have a purpose — to provide info about a person/company. This implementation defeats that purpose.

Plugging in any USB data device is prohibited by most infosec policies. Even if it wasn’t, it’s generally not a good idea. Not everyone has an isolated second computer.

I would argue the business card isn’t the card itself but the blog post detailing how it was made.

Edit: author agrees.

On the other hand, if you want to covertly infect someone's computer, probably don't etch your name and contact information prominently on the PCB of the infecting device.

That’s why you etch someone else’s!

I'm going to assume that someone handing me their contact details is someone I probably don't know well enough to know whether those details are correct.

Why would anyone? You want it to be plausible, but obviously not a loose thread. It'd be a good [and I would hope, obvious] idea to misdirect

Malicious USB devices look like this: https://shop.hak5.org/collections/mischief-gadgets/products/...

Should people be cautious about unknown USB devices? Yes. Should they determine their level of caution based on being able to see a PCB? No.

That is why I provide sources. Inspect them and tell me if you find anything scary. At most, maybe i forgot to implement some corner of USB-CDC spec :D

To be very clear, since someone else got confused: This is awesome, and you should be proud. I'm just probably not plugging it into my work computer. :-p

But you have no way to prove your business card actually runs the released source. And if users are expected to build from source, the card becomes less meaningful.

Similar to the original comment, I fully agree this is a very cool thing. But a business card, which is by definition given to people that likely neither know or trust you, is probably not a particularly good application for it.

Consider this article my business card, and the physical artifact produced by it - a bonus artwork :D

Thinking it this way, the card definitely work very well, excellent job!

Yep, or viceversa it could be a good test, my comment on the other, old, thread:

https://news.ycombinator.com/item?id=21871249

Maybe make it an unshielded USB-A connector and don't implement pins 2 and 3, so there's only the 5v and ground pins.

If you have no way to reach the console, how do you know it's running Linux? Or doing anything at all really? The card has no way to display anything by itself.

Such is the tragedy of USB I suspect: all we need is serial ports, and it's extremely hard to prove that's all we'll be doing.

One could imagine a more sophisticated USB Condom that has a basic uC to implement (only) USB serial on both sides.

If you need all kinds of "condoms", each allowing a single protocol, you lose the "universal" part. It would be just as annoying as specialized adapters.

Also no one would have one for serial.

The same could be said about a portfolio website because there could be a drive by on it.

USB stacks tend to be in kernel space and less hardened, as opposed to browsers which run in user space and are used to being under attack.

Reply on news.ycombinator.com