Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bluetooth keystroke-injection in Android, Linux, macOS and iOS

github.com

Post reply on HN
Print view View original

61–70 of 265 posts

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#61

Post by shzhdbi09gv8ioi »

xp84 wrote: post #35
wtallis wrote: post #20

Earlier quoted context omitted.

Doesn't Android Auto carry audio over Bluetooth? That would be consistent with how unreliable the audio is.

Hey don’t knock it until you’ve tried Apple’s equivalent (wireless CarPlay) which has a 3 second buffer since they decided to use Wi-Fi for audio. Imagine if every time you play or pause or change tracks you have to count to three in your head before it responds. Yes, I’m bitter. Somehow the video and touch are lag-free 1 but the audio is on a delay. I’d love to have regular Bluetooth audio be used.

Your 3-sec delay issue sounds more like AirPlay 1 vs AirPlay 2 issue to me.

AirPlay 1 has this delay (or more like 2 seconds to be fair), while it is reduced to like 200ms on AirPlay 2.

shairport-sync runs on a raspberry AND supports airplay 2. You can hook it up to your car.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#62

Post by rplnt »

kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster).

I used to make the effort when I switched from Android, but I already gave up...

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#63

Post by dotancohen »

acidburnNSA wrote: post #54

Dang it, now I guess I have to toss my out of support android phone that works fine but doesn't support lineage.

What phone? Can you not disable Bluetooth when you are not using the keyboard?

Can Bluetooth HID be disabled without disabling e.g. audio devices (breasts).

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#64

Post by dotancohen »

dotancohen wrote: post #63
acidburnNSA wrote: post #54

Dang it, now I guess I have to toss my out of support android phone that works fine but doesn't support lineage.

What phone? Can you not disable Bluetooth when you are not using the keyboard? Can Bluetooth HID be disabled without disabling e.g. audio devices (breasts).

TIL that "headsets" and "breasts" are close enough on the qwerty keyboard to confuse swiping keyboards.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#66

Post by haraldooo »

rplnt wrote: post #62
kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster). I used to make the effort when I switched from Android, but I already gave up...

Am I missing something? Swipe from the top, tap to disable BT?

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#68

Post by hybridtupel »

haraldooo wrote: post #66
rplnt wrote: post #62

Earlier quoted context omitted.

Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster). I used to make the effort when I switched from Android, but I already gave up...

Am I missing something? Swipe from the top, tap to disable BT?

That’s unfortunately only disconnecting until the next day (see text appearing above when pressing).

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#69

Post by nolist_policy »

> The Linux vulnerability was fixed in 2020 (CVE-2020-0556), but the fix was left disabled by default. ChromeOS is the only Linux-based OS known to have enabled the fix, even though it was announced by Ubuntu, Debian, Fedora, Gentoo, Arch and Alpine.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#70

Post by atoav »

TylerE wrote: post #41
DeathArrow wrote: post #36

>Once the attacker has paired with the target phone or computer A small detail, though, the target device has to accept the connection. Once someone lets you in his house, you can steal his silver, yes.

People are silly about security. Has your social media not been flooded with oldsters circulating that copypasta about how iOS contact sharing is going to let thieves "STEAL YOUR INFO!!1?!111"?

So you are saying this is not true? You mean they got Google to react to a made up vulnerability? Did you even read the text?
Post reply on HN