Kevin Karhan :verified:<p><span class="h-card" translate="no"><a href="https://social.hackingand.coffee/@hon1nbo" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>hon1nbo</span></a></span> <span class="h-card" translate="no"><a href="https://digipres.club/@foone" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>foone</span></a></span> yeah, but all these things would essentially necessitate <em>a fundamentally incompatible</em> <a href="https://infosec.space/tags/Fork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Fork</span></a> of the <a href="https://infosec.space/tags/USB" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>USB</span></a> standard, creating <a href="https://infosec.space/tags/costs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>costs</span></a>, <a href="https://infosec.space/tags/fragmentation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>fragmentation</span></a> and lessen the likelyhood of success.</p><ul><li>Not to mention it'll require significant investments in <a href="https://infosec.space/tags/UserAwareness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>UserAwareness</span></a>, <a href="https://infosec.space/tags/Training" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Training</span></a> and would still have some issues...</li></ul><p>I gues a sort-of <em>"Secure HID Port"</em> that mandates proper authentification and does full <a href="https://infosec.space/tags/E2EE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>E2EE</span></a> from the Keyboard Matrix / Pointing Device controller up is an option, but you'd have to expect state-sponsored attackers willing to do <a href="https://www.youtube.com/watch?v=RyW0lXnoFOA" rel="nofollow noopener noreferrer" target="_blank"><em>"Kamikaze" Hacks</em></a>...</p><ul><li>There's like a <a href="https://www.youtube.com/watch?v=U7VwtOrwceo&t=4m5s" rel="nofollow noopener noreferrer" target="_blank">long talk</a> by <a href="https://infosec.space/tags/TonyChen" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TonyChen</span></a> from <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Microsoft</span></a> explaining how they secured the <a href="https://infosec.space/tags/XboxOne" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>XboxOne</span></a>.</li></ul><p><a href="https://infosec.space/tags/TLDW" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TLDW</span></a>: <a href="https://www.youtube.com/watch?v=U7VwtOrwceo&t=11m2s" rel="nofollow noopener noreferrer" target="_blank">It requires custom silicon and a hard root of trust</a>…</p><ul><li>And as we saw with <a href="https://infosec.space/tags/GoldenKeyBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GoldenKeyBoot</span></a> all it takes is a single <a href="https://infosec.space/tags/leak" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>leak</span></a> of a <a href="https://infosec.space/tags/PrivateKey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PrivateKey</span></a> and that entire system is fucked!</li></ul><p><a href="https://infosec.space/@kkarhan/113716442182953660" translate="no" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://</span><span class="ellipsis">infosec.space/@kkarhan/1137164</span><span class="invisible">42182953660</span></a></p>