Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bluetooth keystroke-injection in Android, Linux, macOS and iOS

github.com

Post reply on HN
Print view View original

51–60 of 265 posts

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#51

Post by kelnos »

SpikeDad wrote: post #4

Well iOS and macOS are only vulnerable in a very narrow range of conditions. On the other hand Android is a field day. And I believe these were patched in the current versions of iOS and macOS.

I was pretty surprised to see that Linux/BlueZ is only vulnerable under a very specific, rare situation. And fixing it for that situation doesn't even require a patch, just a small change to a configuration file. BlueZ (and its related GUI tools) otherwise is a usability nightmare. At least it's decently secure?

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#52

Post by wtallis »

kelnos wrote: post #48
xp84 wrote: post #35

Earlier quoted context omitted.

Hey don’t knock it until you’ve tried Apple’s equivalent (wireless CarPlay) which has a 3 second buffer since they decided to use Wi-Fi for audio. Imagine if every time you play or pause or change tracks you have to count to three in your head before it responds. Yes, I’m bitter. Somehow the video and touch are lag-free 1 but the audio is on a delay. I’d love to have regular Bluetooth audio be used.

Wait, what? Wifi? Does that mean that a car that has CarPlay must also have Wifi that can act as an access point, and do some sort of automatic connection negotiation when the phone is plugged in and CarPlay is activated? That seems... terrible.

Wireless CarPlay didn't show up until several years after the original USB-based CarPlay, which is still around and there may still be new vehicles on the market which only support the USB-based CarPlay. Wireless CarPlay starts with a Bluetooth connection which is then used to negotiate the higher-bandwidth WiFi link. Neither CarPlay nor Android Auto can operate on Bluetooth alone, because the video data that needs to be streamed far exceeds what Bluetooth can handle.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#53

Post by aydyn »

kelnos wrote: post #47
bee_rider wrote: post #33

Earlier quoted context omitted.

Wireless keyboard generally seem like a totally terrible idea, just waiting for hacks. The author mentions not going after wireless gaming keyboards because they were the “wrong kind of mess,” I assume, security through abstrusity :)

I never really understood the benefits of a wireless keyboard. Do people usually carry their keyboard from their desk with them when they take their laptop somewhere else? I guess I could maybe -- maybe -- see the convenience if you have some sort of small-form-factor keyboard that you stash in your bag. But still, the wire doesn't seem like much of a burden, and personally I'd find the annoyance of needing to ensure…

I don’t see how people can STILL use wired nowdays. It’s so much less desk clutter and vastly better aesthetics to go full wireless.

Charging is not an issue, get some Logitech that lasts months if not years.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#55

Post by strogonoff »

kelnos wrote: post #47
bee_rider wrote: post #33

Earlier quoted context omitted.

Wireless keyboard generally seem like a totally terrible idea, just waiting for hacks. The author mentions not going after wireless gaming keyboards because they were the “wrong kind of mess,” I assume, security through abstrusity :)

I never really understood the benefits of a wireless keyboard. Do people usually carry their keyboard from their desk with them when they take their laptop somewhere else? I guess I could maybe -- maybe -- see the convenience if you have some sort of small-form-factor keyboard that you stash in your bag. But still, the wire doesn't seem like much of a burden, and personally I'd find the annoyance of needing to ensure…

A laptop by default is not suitable for working any substantial length of time due to the fixed coupling between its screen and keyboard. Separating them—so that you can relax while keeping your screen roughly at your eye level and at comfortable distance, and your elbows bent at comfortable 90 degrees (or more)—gets you 80% there in terms of ergonomics.

You could carry around a portable display, but that might be a bit of an overkill in terms of cost and bulk. Unlike a display, a portable keyboard is lighter and often smaller than the laptop itself. Modern wireless keyboards have almost no lag, have nice mechanical keys with replaceable keycaps, etc.

Working away from a stationary setup, I consider a separate keyboard a must—and particularly a wireless keyboard, since the one thing that reliably breaks on every laptop is physical I/O, especially USB/USB-C ports (and every time plugging/unplugging another accessory brings that closer).

Working with a stationary setup you have a detached keyboard anyway, and if it’s wired you don’t really need to unplug it, like, ever, so a wireless keyboard loses a lot of its advantages—though if you have a really large screen and have a lot of leeway for moving your chair around for comfortable work not having cables get in the way might be nice as well.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#56

Post by charcircuit »

xp84 wrote: post #35
wtallis wrote: post #20

Earlier quoted context omitted.

Doesn't Android Auto carry audio over Bluetooth? That would be consistent with how unreliable the audio is.

Hey don’t knock it until you’ve tried Apple’s equivalent (wireless CarPlay) which has a 3 second buffer since they decided to use Wi-Fi for audio. Imagine if every time you play or pause or change tracks you have to count to three in your head before it responds. Yes, I’m bitter. Somehow the video and touch are lag-free 1 but the audio is on a delay. I’d love to have regular Bluetooth audio be used.

>since they decided to use Wi-Fi for audio

Choosing to buffer for 3 seconds isn't the fault of wifi. There is no reason it couldn't start playing in a few milliseconds.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#57

Post by Koffiepoeder »

overstay8930 wrote: post #40
DeathArrow wrote: post #36

>Once the attacker has paired with the target phone or computer A small detail, though, the target device has to accept the connection. Once someone lets you in his house, you can steal his silver, yes.

How in the world is this a CVSS 8.8 if this is the case? What a waste of everyone's time if this is true.

Ctrl+alt+t (insert malicious shell command)

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#60

Post by shzhdbi09gv8ioi »

kelnos wrote: post #47
bee_rider wrote: post #33

Earlier quoted context omitted.

Wireless keyboard generally seem like a totally terrible idea, just waiting for hacks. The author mentions not going after wireless gaming keyboards because they were the “wrong kind of mess,” I assume, security through abstrusity :)

I never really understood the benefits of a wireless keyboard. Do people usually carry their keyboard from their desk with them when they take their laptop somewhere else? I guess I could maybe -- maybe -- see the convenience if you have some sort of small-form-factor keyboard that you stash in your bag. But still, the wire doesn't seem like much of a burden, and personally I'd find the annoyance of needing to ensure…

My cats insist on sleeping on the desk, so wireless keyboard & mouse is a must for me so I can navigate around cats.

They all is USB-C charged so I use a single charger cable for macbook, gaming controller, keyboard and mouse.

Post reply on HN