Free Software Will Help Detect Faulty and Malicious USB-C Cables 113
Reader Mickeycaskill writes: The USB 3.0 Promoter Group, of which HP, Intel and Microsoft are members, has developed authentication protocols for USB-C and will offer free software to detect faulty or malicious cables.This tool will alert users if they are using a non-authenticated cable. It has been suggested that hardware manufacturers could ship devices with an authentication system already installed. It is hoped that the specification will help end a number of recent incidents where sub-standard cables have either ripped off buyers or damaged devices. Most recently, Amazon said it would be adding USB-C cables and adapters that do not comply with standard regulations to its list of prohibited electronics items.
Re: (Score:2)
Which is nice until someone [exploits these cables to] delete all your cat photos.
No, you're thinking of Cat Negative One cables.
Re: (Score:2)
just don't try using crossover cables! it may convert your cat into a dog.
Re: (Score:2)
Re: (Score:1)
If the cat feels it really should be a dog there is nothing wrong with that.
But should it still use the litter tray?
Re: (Score:1)
There should be a litter tray outdoors, too. To accommodate the cat that insists it's a dog and will only shit outdoors, but also insists on clean clay-based (or clumping, on special request) litter to shit in.
Re: Software to detect bad cables? (Score:1)
Nah, you just use a low voltage and current until it's authenticated
What I don't get is couldn't anyone just read the spec and make an "authenticated" cable?
Re: (Score:2)
I think that's the point, read the spec and make a cable to the spec, i.e. a good cable. Or do you mean just read the bit of the spec that does the authentication and then still use bad wire? Probably not worth the effort of only doing half a decent job rather than going the full way, hopefully anyway.
Re: (Score:2)
That will depend a lot on how easy it is to spoof the authentication.
And it makes me wonder if this also could become a way of locking cheaper, but still legit cable makers out of the market.
So, again, much depends on the implementation.
Re: Software to detect bad cables? (Score:4, Insightful)
until it's authenticated
Until what's authenticated? That it's a cable? I've read the USB press release and a few other articles and there's no indication anywhere as to what this "authentication" is authenticating. If I take an authentic USB 3.0 cable with authentication and authentically send 10,000 authentic volts down it, does it authentically help the authentic owner of the authentically fried device to know that it's been authentically authenticated?
Re: (Score:2)
USB Type C cables aren't just wire. "Full-featured type-C cables are active, electronically marked cables that contain a chip with an ID function based on the configuration channel and vendor-defined messages (VDMs) from the USB Power Delivery 2.0 specification." (from Wikipedia).
The non-compliant cables that were being sold on Amazon probably don't contain spec-compliant chips, and that is something the testing software can check. A compliant cable still won't prevent damage if you connect a 10,000 volt so
Re: (Score:2)
I presume that authentication would mean plugging in the both ends of the USB cable into a test device which has a light per cable. If there was any cross wiring, open wire or short, the cable would be rejected.
I am not sure that measurements would include frequency response (capacitance leakages).
Re: (Score:2)
You are thinking about the one that fried some googler laptop.
This has NOTHING to do with it.
it will continue to fry your computer. This has to do with the fact that the cable itself now has a processor, like the lightning cable. or a usb hub.
This code, which they will force on the kernel upstream i bet, will make sure that the image running there is from some trusted vendor. Something like calling an API getVendorID and then the chip on the cable would return "copyrighted string ABC" so that they can sue m
Apple can use this to lock in $20-$30 cables and (Score:3)
Apple can use this to lock in
$20-$30 cables
$30-$50 USB3 TB / MINIDP to DVI / VGA / HDMI.
$20 USB3c to USB.
$30 USB3 to GIG-E.
Re: (Score:2)
Apple already has a hardware-based authentication baked into the MacBook that supports USB-C, so this software-based approach won't really change anything for them. All it may do is help USB-C become more widely-adopted, which is something we should all want, given the benefits it provides over its predecessors.
As for Apple making ridiculously expensive dongles and adapters, they'll do that regardless of any sort of lock-in. Just look at Lightning cables. You can buy MFi (Made for iPhone) Lightning cables f
Re: (Score:1)
Significantly more?
http://www.amazon.com/s/ref=nb... [amazon.com]
Apple cable $7.50
Amazon Basics cable $7.99
I love it how you apple haters make up shit to try and prop up your hate.
Re:Apple can use this to lock in $20-$30 cables an (Score:5, Informative)
You're factually wrong on so many counts that it's not even funny.
A) The cables you're comparing are different lengths. 1m for the "Apple" cable [amazon.com] vs. 2m for the Amazon cable [amazon.com]. No wonder it's cheaper.
B) That "Apple" cable is being sold by a third-party [amazon.com] via Amazon. Apple doesn't sell a single one of their products directly via Amazon. Buyer beware.
C) To compare apples to Apples, an actual 2m Apple cables [apple.com] costs $29 ($19 for 1m), not the $7.50 you suggested it was.
D) If you want to whip out your Apple e-peen to see if it's bigger than mine, I'd wager good money I have you beat. Macs have continuously been my primary computers since the late '80s. A Mac Classic, Performa 400, PowerMac G3 300, Titanium PowerBook DVI, HiRes Aluminum PowerBook, 2008 Mac mini, 2011 Mac mini. My wife uses them, my parents use them, my siblings use them, and my wife's siblings and parents do too. Likewise for phones and tablets: iPhone 3G, iPhone 4, iPhone 5s, iPad 2, and iPad Air 2. I could list off Time Capsules, Airport base stations, and other accessories too, if you'd like.
I use Apple products on a daily basis and absolutely love them (we're planning to buy an iPhone SE this weekend, in fact, assuming they're in stock), but there's no (sane) way to deny that actual Apple dongles and cables are far more expensive than their generic counterparts. It's no different than the advice we'd give people about BTO RAM upgrades: do it yourself after buying from a third-party.
So, as someone whose love for Apple likely runs far deeper than yours: stop with the lies and misinformation, since it makes us all look like we have no clue what we're talking about.
Re: (Score:2)
the Amazon cable is twice the length.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Authentication as Structural Monopoly (Score:3)
And you are free not to buy their overpriced USB cables. Period.
Right up until the point where they use authentication to prevent it from working. Like Dell with their power adapters. (Oh, you didn't pay the dell power supply tax, so your 19.5V can't be allowed to charge the battery!)
There are good reasons for authentication--it's very hard to find USB cables that are actually up to spec. It has cost these companies probably millions of dollars in development time to hunt down bugs related to USB cables that are below spec.
But the solution isn't authenticated cables-
Re: (Score:2)
Right up until the point where they use authentication to prevent it from working. Like Dell with their power adapters. (Oh, you didn't pay the dell power supply tax, so your 19.5V can't be allowed to charge the battery!)
Again, if they use authentication, you can buy someone else's cables, not Apple's if they are following the USB standard. As for Dell, those are Dell Power supplies. They were designed and made by Dell not some standard. As is the same with Toshiba, Apple, etc and their power supplies.
There are good reasons for authentication--it's very hard to find USB cables that are actually up to spec. It has cost these companies probably millions of dollars in development time to hunt down bugs related to USB cables that are below spec.
Conforming to standard isn't hard or extremely expensive. It's just some companies cut corners. Monoprice [monoprice.com] has them for cheap and their cables been given good ratings by Leung.
But the solution isn't authenticated cables--it's having a robust cable testing protocol. Authenticated cables are fine and can be helpful, so long as they don't *disable* non-authenticated cables, but on their own they don't solve the underlying problem.
I would think that doesn't solve the problem as it
Re: (Score:2)
But the solution isn't authenticated cables--it's having a robust cable testing protocol.
I would much prefer my device to have software or hardware that would determine whether the cable was ok than to have to follow a "robust cable testing protocol" for every new cable I use.
Re: (Score:2)
Of the 825 USB group members... (Score:2)
Why bother to name those particular three?
Re: (Score:1)
They probably paid the most for the press release
What?! (Score:1)
'Non-authenticated cables'?! what dystopian hell have I awoken in?!
Re: (Score:2)
Re: (Score:2)
Yes... but. (Score:4, Interesting)
There have been bad cables out there that put in the wrong spec resistor or are otherwise mis-wired. However, I don't agree that "authenticating" the cables is the answer. The word "authentication" implies that there will be key exchanges involved, which puts all the pieces into place for vendor lock-in (i.e. LG devices only charge with LG certified cables, etc... ), not to mention additional cost and complexity. I for one already have a selection of USB-C compliant chargers and cables (yes, using Benson's spreadsheet). Will those be accepted by new USB-C devices supporting this specification? Will there be a supply of cheap USB-C cables that support this "authentication" AND work with every device vendor? I doubt it on both accounts. I prefer Benson's approach of shaming the vendors that don't follow the spec.
Re: (Score:2)
There have been bad cables out there that put in the wrong spec resistor or are otherwise mis-wired.
Um no. Some of these cables are just poorly made and do not pass the USB C specification but may say that they do. Just remember Apple had to address counterfeit chargers a while back.
The word "authentication" implies that there will be key exchanges involved, which puts all the pieces into place for vendor lock-in (i.e. LG devices only charge with LG certified cables, etc... ),,
Why would you think that? DVD movies are authenticated and do not involve vendor lock-in or key exchanges. Remember this is USB not LG proprietary cables. Can this system be defeated? With 128 bit security, probably, however the point it to raise the bar of manufacturing so that cheap knock-offs are not likely.
why are we cheering DRM? (Score:3)
People get tired of USB being affordable and pine for a more Firewire-type system?
Why are we hoping for authenticated cables?
Re: (Score:2)
My thoughts exactly. What we actually need is cheap hardware testers, available at any store so the consumer can test the cables before bringing them home. Online stores could state more confidently their cables were actually tested too.
Re: (Score:1)
The hardware testing functionality could be added into the actual devices that use the cable. So you plug in sketchy cable X and your device measures performance and rejects using it.
Instead, this is sounding more like a whitelist deal.
Re: (Score:2)
It doesn't justify the cost... you only need to test the cable once, when you're buying it. If your work involves dealing with lots of cables, then buy a tester.
Re:why are we cheering DRM? (Score:5, Informative)
It's not really DRM. The "authentication" information is more an informational block - like EDID in monitors, SPD in memory modules and such.
The reason is it allows for smarter management. A USB-C charger can provide up to 100W of power, but you need some way of telling the device that it's available, and the current methods are generally quite... crappy. But you also don't want to have the charger implement a full USB stack. So you implement this mechanism and it tells you how much power you can draw. And if you use a crappy USB cable that doesn't put in the resistors correctly, you could detect that as well and charge at the agonizingly slow rate, while displaying a dialog to change the cable to a certified one because it's wired incorrectly.
Basically this whole thing stemmed from that Google guy reviewing all the USB-C cables out there, and finding a huge number of them were pretty awful and resulting in crippled charger performance, if the devices could charge at all.
It's less about tying products and accessories together and more about being able to tell the user that the $1 USB-C cable they bought is incorrectly manufactured and to expect problems like slow charging or slow data transfers.
Re: (Score:3)
Re: (Score:1)
Re: (Score:3)
Re: (Score:2)
It's not DRM. Cables that support the more advanced features of USB-C (such as super speed, alternate modes, high power delivery levels etc) have a small microcontroller inside them which informs the host about what the cable is able to do. This is not required for cables that only support USB low/full/high speed. If this was not present, then a host can't decide whether the cable connecting it to the device is going to fry if it sends 50W of power down it. But the cable just reports and ID and capabilities
WTF (Score:2)
For me, this currently seems like a joint venture of trying to get cheap competition out of the market: you must join the cartel in order to be "certified", but once you are, you can do what you want.
There is no additional protection for the user who doesn't trust that cartel.
What about not auto-mounting a smartphone? You don't need to mount anything when you connect to a charging device. Also helps if you connect your smartphone to a stranger's computer to charge it.
You would still need encryption if you i
Re: (Score:3)
Mallicous? (Score:2, Insightful)
So the cables are deliberately causing fault or do you mean the manufacturers? It's hard for me to believe than an inanimate object has malicious intent.
Re: (Score:2)
Re: (Score:2)
Well I'm talking specifics. I mean the next thing I'll read on slashdot is that "USB C cables leap out of drawers and strangle their owners"
That would be malicious and a boring sci-fi story. Wait they made two sharknado movies, never mine.
Re: (Score:2)
So the cables are deliberately causing fault or do you mean the manufacturers? It's hard for me to believe than an inanimate object has malicious intent.
Or maybe it wasn't the manufacturers but the designers, or maybe the transport company tampering with them, or maybe the warehouse opening them up and modifying them, or maybe the store deliberately causing fault...we must ensure all bases are covered because otherwise nobody will be able to understand.
Re: (Score:1)
Probably the controllers embedded in the cable will have eeprom elements that are vulnerable to cosmic rays, and also subject to the medium-term 'eprom alzheimer' issue that older eproms have.
So your cables will die in a decade or so.
Wonderful. Not that it matters, of course, because who would be dumb enough not to pitch out their tech gear every two or three years, right?
Re: (Score:2)
Probably the controllers embedded in the cable will have eeprom elements that are vulnerable to cosmic rays, and also subject to the medium-term 'eprom alzheimer' issue that older eproms have.
And who could be responsible for that? Better add them to the possible "malicious" parties, wouldn't want anybody getting confused now.
Re: (Score:1)
What problem does this solve? (Score:2)
Re: (Score:2)
Lower profits for the company that holds the licensing.
It's a shitty standard.... (Score:4, Insightful)
when you cables need to be "authenticated"....
Honestly, Everyone bitches about Apple, but the rest of the world is doing the same fucking thing, my cable should not have to authenticate to anything. and should just contain plastic, metal connector pins and copper wires to take it to the other end.
Re: (Score:2)
Re: (Score:1)
Yes, I just want one cable type. Preferably it will be made with stranded 10 gauge copper wire, so that it can not only carry data, but also immense amounts of power. And the universal plug might be a 1 x 3 inch rectangular nightmare, but it will do anything we want.
Re: (Score:2)
Proprietry Cables (Score:2)
The lengths that bean counters will go to (Score:1)
to save a couple cents worth of clamping diodes and fuses per USB port...
Re: (Score:1)
That isn't what they're saving.
They are saving their brands, from commodification.
Is it worth it? (Score:5, Insightful)
USB has become succesful because it was cheap and simple to use and cheap and simple to manufacture. It seems to me that USB-C is getting further and further away from that by the day. Maybe different use cases require different solutions, maybe there is no such thing as a 'one universal cable' that can combine the advantages of all the others without the disadvantages. It seems like USB just wanted to replace lightning on Apple stuff, and does not care about PC users who don't have a fortune to waste on a piece of wire. Which is not even just wire anymore, it contains its own electronics, losing all the elegance and simplicity tha made USB great.
Re: (Score:2)
Yes, it probably is.
I have been developing on the embedded side of USB since V1.1. The reality is that the protocol has been remarkably successful because it was designed reasonably well right at the start. This meant that each successive extension to the standard was able to do so in a way that preserved backwards compatibility with older standards. The benefit of this now is that if you don't want the new features of USB-C (super-speed, power delivery) then upgrading your device to USB-C is as easy as cha
Software? (Score:1)
How useful is this? It seems like it would lock out competing low-cost cables while not dealing with the really bad ones. If a cable has a fault which will fry your computer/port, software isn't going to help much by that point.
A hardware device might work better.
Just, no. (Score:4, Insightful)
The *LAST* thing we need is a USB cable with active components in it. It's almost bad enough that some charging cables have a small resistor in them, because now there are a million different standards of them.
Also, if the ground and power wires are swapped at one end like the cable that killed the chromebook of that google employee, then no software is going to help at all. As soon as you plug it in, it will already have damaged your hardware.
Here is what we *DO* need: USB cables that are transparent so you can SEE the colors of wire going to the pins of each connector. *THIS* is what will prevent damage due to bad cables. Your "software" is not needed, and wouldn't help anyway.
Re: (Score:3)
Here is what we *DO* need: USB cables that are transparent so you can SEE the colors of wire going to the pins of each connector. *THIS* is what will prevent damage due to bad cables. Your "software" is not needed, and wouldn't help anyway.
Or... you know... purchasers who aren't going for $.03 "USB3c 15ft MAXBESTDEALYOUBUYAWESOMESAUCE!" By and large, if you buy from reputable distributors, this is a non-issue.
Re: (Score:2)
Or... you know... purchasers who aren't going for $.03 "USB3c 15ft MAXBESTDEALYOUBUYAWESOMESAUCE!" By and large, if you buy from reputable distributors, this is a non-issue.
I agree that ridiculously cheap cables are probably no good, but that by no means guarantees that a more expensive cable will be better. Amazon, with all its various marketplaces does a good job obfuscating exactly whom I'm buying from, so it's hard for me to even tell what choice seems the most reputable. So at this point, it's still feeling like an informed gamble.
I think this will naturally change as USB-C becomes more popular. The good cables will be well-rated, and show up more prominently in search re
Re: (Score:2)
The *LAST* thing we need is a USB cable with active components in it.
We already have those. All USB-C cables have a chip in them.
It's almost bad enough that some charging cables have a small resistor in them, because now there are a million different standards of them.
Nope. There's precisely ONE current standard, BC1.2. The fact that some manufacturers choose to ignore that and do their own thing does not make it a standard.
Also, if the ground and power wires are swapped at one end like the cable that killed the chromebook of that google employee, then no software is going to help at all. As soon as you plug it in, it will already have damaged your hardware.
That's not the issue. That's just the single worst case. There are hundreds of cables on the market which don't meet the required signalling spec. That is what this software is chasing.
Here is what we *DO* need: USB cables that are transparent so you can SEE the colors of wire going to the pins of each connector. *THIS* is what will prevent damage due to bad cables. Your "software" is not needed, and wouldn't help anyway.
No that is NOT what we need. In fact what we need is manufacturers to be held to some testing standard. What
Re: (Score:2)
Using Free Software to enforce proprietary hardware is pretty messed up.
Is it even Free(dom) Software? I had a quick look at the article and could only see that it's Free (of charge) Software...of course the two aren't mutually exclusive.
Unbelievable (Score:2)
It isn't even widely adopted yet, and it's already causing a massive clusterfuck.
Why did they have to make the standard so stupidly complicated? What were they thinking?
Not really a "cable" any more, is it? (Score:2)
If "cables" are going to have authentication chips and whatnot inside them, they're not really just cables any more, are they? They're more like a third device to put between two other devices.
Do they really have to be so much more than just a certain number of pins in a certain pattern connected to the same at the other end by conductive material?
Not an authentication chip (Score:3)
It's not an authentication chip. It is just a chip that reports what the cable can do. If they didn't do it this way you would either have to design every cable to be able to deliver 50W of power and superspeed channel buffers, or you'd have to come up with a different scheme - such as the variable resistor values used before - to indicate what the cable can do. This also gets complicated fast, and is not easily extendable in the future. The active cable protocol is quite simple, and makes the whole system
Re: (Score:2)
High Power Issue (Score:4, Informative)
I think a part of the problem with USB-C is that it can handle up to 100 watts of power delivery! If your cable is of questionable quality or has issues, messing up 100 watts of power can definitely break things or cause a fire. I think amazon decided to go the safer route instead of destroying equipment or causing fires.
Re: (Score:2)
I think a part of the problem with USB-C is that it can handle up to 100 watts of power delivery! If your cable is of questionable quality or has issues, messing up 100 watts of power can definitely break things or cause a fire. I think amazon decided to go the safer route instead of destroying equipment or causing fires.
Exactly! For just about any other type of digital cable, if I get a dud, the worst case scenario is, it simply won't work. That means it's pretty safe for me to buy the cheapest HDMI or micro USB cable I can find, knowing that if it doesn't work, I can always return it.
Re: (Score:2)
No the problem of USB-C is tighter spec requirements. The power delivery requirements is only a small part of the failures that have been noted which include problems with the signalling, impedance, and shielding as well.
As speeds go up and sizes go down things start getting closer and closer to not working. Take a look at a typical USB hub. Especially the ones with single sided PCBs. Take note that it's impossible to actually meet the impedance requirements of the USB 2 spec let alone USB 3 when using surf
Re: (Score:1)
I'd rather have a hardware cable tester (Score:1)
If computer stores could buy a good, reliable cable tester - one that that tested the actual hardware for compliance with the actual spec - for under $100, it would make a great marketing tool.
Re: (Score:1)
Part of the hardware tester could be built right into the devices the cable is used with. Line drop is fairly trivial to determine by comparing voltages at either end of a cable. So the cables that are going to start fires will have a high line drop, the devices interconnected will determine this, and refuse to use the cable.
That's too complicated, though, and it doesn't encourage proprietary barriers. Everybody knows vendors make all their party money on cables and accessories.
cable quality (Score:1)
Re: (Score:1)
Just buy them?
Definitely not. You'll have to wait in line in front of the Apple Store like the rest of us.
CABLES should be dumb and simple (Score:1)
The only thing I want in a CABLE besides wires and insulation and maybe a matching transformer or other "if it's not there it won't work" things are safety systems, such as a fuse or idiot-proof/keyed endings/pinouts.
If it's got anything else, it deserves a title more glorified than "cable." Maybe "adapter" or "connector" or "extender" (think USB-2 extension cables with button-batteries in them to boost the signal) but not a lowly term that implies simplicity like "cable."
Uh, It's Not Necessarily A Case Of Either/Or (Score:1)
A non-authenticated cable isn't necessarily faulty or malicious. I was hoping when I saw the article that the software would do actual analysis and measurement of said cables. Like run traffic or power through them and determine performance.
It doesn't matter one bit if said cable is 'authenticated.' So this is just more DRM shit cloaked as something 'free' and helpful.
"Free" as in "Free beer" (Score:1)
> Free Software Will Help Detect Faulty and Malicious USB-C Cables
Reading the article, I see no relation with "Free Software" mentioned and "Software Freedom."
May be deliberate as how media changed the meaning of "Hacker."