virtualice is a user on octodon.social. You can follow them or interact with them if you have an account anywhere in the fediverse. If you don't, you can sign up here.

concept: encrypted usb protocol to prevent hardware keyloggers and such

@kity how do you know there's someone in the middle, or how do you know you're talking to the pc or keyboard

you have to maintain private keys and certificattes and the whole thing and someday someone will extract it from the OS and a cheap keyboard and make a keylogger with both. maybe you could associate each keyboard with each pc but it becomes cumbersome even for an enterprise.

basically same as for drm, it's a lot of effort and not much security

@CobaltVelvet @kity Arguably it would be enough to encrypt the data transfer and allow the host to decide if it wants to allow the device with a prompt, similar to how bluetooth requires permission, no need to involve certificate infrastructure (or even bidirectional trust if we're only concerned with a host protecting itself from the devices)

@elomatreb @kity but how do you exchange the key? if there's a device in the middle like a usb keylogger, you have to authenticate both ends, otherwise the device will just encrypt each side and relay the cleartext while logging

@CobaltVelvet @kity Per-device key, similar to how many-to-many end-to-end chat encryption works, probably? Would create bus overhead relative to the number of devices that share a channel of course, but arguably that could be a worthwhile tradeoff for security

@elomatreb @kity like, settings the key manually when you know there is no keylogger? sure

@CobaltVelvet @kity Unless I'm missing something each device would only have to keep a persistent key to authenticate itself by signing an address/the initial key exchange, the actual transport key could be ephemeral
virtualice @CobaltVelvet

@elomatreb @kity yeah the keyboard wouldn't know the pc changed but the user would quickly notice it being disconnected or it would be detected as an unknown keyboard

nice

· Web · 0 · 2

@elomatreb @kity but then someone capable of installing a usb keylogger would surely be able to get access to the pin if it's written under it

so it should be generated at some point, copied to the host, and then kept reasonably secret