daveyOsborn

1

Oh, so to be clear, an asus laptop that expects a USB PD supply can still detect whether or not it’s an OEM charger? And when it’s non-asus, it distrusts the capability and only draws 65w even if the PSU can do 100w?

IIUC, that’s a bit fucked up. I’ve read claims that either USB PD or the proprietary 3-pin predecessors are supposed to be smart enough so appliances can go easy on PSUs that are not up to the full load, but I was expecting USB PD to not have vendor favoritism problems like that. I appreciate the tip. Seems like another gotcha that can even burn above average consumers who know to a reasonable extent what they are doing.

(update) found this

Myth #2: "Original Chargers Are Always Best" Truth: Not anymore.
Many manufacturers use cheap chargers to cut costs. A quality USB PD charger often beats what's in the box.

So I have to wonder if an asus laptop would actually nanny a non-asus PSU that is better than the asus oem psu.

daveyOsborn @infosec.pub 2d ago

You’re misreading the blog post. That adapter has 19.5V written on it, but it requests 20V. 19.5V is not a PD voltage.

We know the /result/ is 20v, not what was requested. It’s a lie and abuse to print 19.5v on an adaptor that is actually just requesting 20v. It’s certainly /possible/ that is what is happening, which obviously proves my point nonetheless. It’s yet another demonstration of the USB PD shitshow. Either way in fact. Whether the negotiation is a lie, or whether the source is saying “close enough, will send 20v”, it’s a shitshow either way.

But now it’s worse because consumers who know how to pay attention to voltage are getting a product that’s not delivering what they signed up for.

Worth noting that the PPS spec of the PD3 standard allows for 20mV step adjustments to the fixed voltages. If the 19.5v adapter is not lying, it’s trying to down-step the 20v (which will only work if the source PSU is PD3 or higher). And indeed the author’s PSU supports PPS. Yet despite that, consumers are still not getting what they believe they signed up for.

The latter is pretty much impossible to make to spec, because it can’t negotiate voltage. A barrel jack is single-voltage by necessity.

First of all, the adapters exist. Not impossible. If you meant to say a smart negotiating one is impossible, I don’t believe that either. It could detect whatever the barrel passes and use that result to negotiate only for that available voltage. It could even have a voltage converter that supplies voltages that differ from the source. In fact I have a DC-DC adaptor. You probably have one and don’t know it. A USB charger that plugs into a car’s cigarette lighter converts 12v to 5v. I have one that has a variety of tips and a range of voltages. Detecting the source voltage may not be cheap, but not impossible. It would also be possible to have a cheap manual switch to specify input voltage.

Respectfully, I’m going to have to disagree. It’s much more interesting when it catches fire, and I’d rather have a protocol that sometimes doesn’t operate in order to avoid the excitement of one that sometimes explodes

If you find explosions interesting, you can go play with fireworks or watch war movies. It’s not academically interesting that tech illiterate consumers find countless ways to shoot themselves in the foot. When engineers --- who /should/ know what they are doing, push a shitty standard that burns even consumers who have the basic knowledge to match devices, that’s academically interesting because it’s people we expect to be smart fucking up. When a whole industry fucks up, that’s academically interesting. I cannot charge a 5v bicycle light using a USB PD spec’d PSU because the industry fucked up on the meaning of “default”.

No matter what charging standard you use, some idiot could cut off the end, wire it to a stun gun, and send 100,000V into your phone. That doesn’t make the standard bad, it makes the adapter bad.

Dumb consumers are not in short supply. It used to be that only tech-illiterate consumers were getting burnt. Which created an incentive for consumers to gain knowledge. The nannying attempt at a remedy has enabled informed consumers to get burnt. At the same time, it dumbs down society. When expert consumers can get burnt, of course it reflects a poor standard.

And poor practices. A good standard anticipates what the market will do. They did not anticipate different product makers having a different interpretation of “default”.

but as long as nothing breaks, I’d consider it as foolproof as anything reasonably can be.

It’s now clear why you have no problems with the standard -- you have a low expectation. The Lenovo PSU that supports 5v /should/ be able to charge a 5v appliance. But they botched the negotiation and absence of it. When both sides of the negotiation are compatible in terms of physics but they cannot work together because of a miscommunication, it’s a shitty standard.

The whole point of a standard is to establish an expectation that different components /function/ together. Doing that without fires is a given but not the end game.

The blog shows situations where voltage is substantially less. It’s a general rule of thumb that supplying too little voltage usually does not damage things, but I do not think that is absolute.

That’s just how electricity works.

I was describing how /people/ work.

3

daveyOsborn @infosec.pub 3d ago

I’m not grasping what you’re saying. What is it that asus is doing on their USB PD laptops and tablets?

daveyOsborn @infosec.pub 3d ago

Look it up on youtube

I don’t do youtube, which has descended into a shitshow of Google blocking both Tor and also killing off invideous instances. But I have seen some hacker pages with pics of this hacking. In any case, it’s a mess. It used to be that only dumb consumers got burnt (as they would mismatch voltages). But now smart consumers can get burnt too because even when the levels are good the nannying protectionism cock-blocks.

2

daveyOsborn @infosec.pub 3d ago

I’m getting the sense from your comments that you think that USB-PD will deliver a higher voltage than requested. This is not accurate. A device can request any of the voltages specified by PD, and the power supply will supply that voltage if it is capable of doing so. If not, it will provide 5V. It’s very possible to get a sippy that won’t power your device,

See the experiment I linked in the post that you replied to. If 19.5v is requested, 20v is supplied. If 12v is requested, 9v is supplied (not 5v). But also since 9v is optional, some PSUs would push 5v. So the voltage you get depends on what the PSU makers feel like sending.

but a working, PD-compliant power supply will not damage a working, PD-compliant device.

Yet they will fail because compliance is subject to interpretation and the ambiguities are disputed. Try plugging a USB-C bicycle light into a Lenovo USB-C PSU. Even though they both handle 5v, it fails. The Lenovo device makers believe all voltages, even 5v, must be negotiated. The bicycle light makers believe a 5v “default” /means/ they should get 5v without negotiation. The Lenovo PSU makers believe “default” means 5v will be the result of a failed negotiation (but not absence of negotiation).

And other device makers believe USB PD requires supplying the closest voltage when negotiation fails, not 5v. Those people probably also believe 5v should be sent in the absence of negotiation.

Obviously, if you get a barrel jack adapter that requests 20V and then plug it into a 5V device, you’re going to let the magic smoke out, but that’s because barrel jacks don’t do negotiation. The power supply correctly supplies 20V as requested, and then you plug that 20V into the wrong thing.

You’re mixing up the different adapters. You can have a USB→barrel and you can have a barrel→USB. The interesting case is what I described, when the appliance and PSU are compatible in terms of voltage but still fail because of the protocol. Also consider that a 20v barrel PSU could feed a dumb usb-c adapter which then fries a 5v device. In principle, the adapter /could/ do a negotiation and refuse to supply 20v to a 5v device, or even just cut-off anything above 5v, but the shitshow that we have is a marketplace with dumb adapters. And in both situations (usb→barrel and barrel→usb), it’s not foolproof. Countless consumers cannot handle the voltage matching task so if the plugs fit, they will try it.

daveyOsborn @infosec.pub 4d ago

That’s no part of USB spec

Do you mean the USB PD spec? It does not violate the USB spec which sets a default voltage of 5v. The adapter /might/ violate the USB PD spec if it were to claim to be PD compliant. But the shit-show we have is that USB-C does not imply USB PD. And so the market is full of USB-C things that are not USB PD. Often they do not claim to be USB PD as consumers are not wise enough to demand it. AFAICT, USB-C devices that do not mention USB PD would stand up in court.

Note as well the adapter I mentioned is quite dumb -- just hardwires pins for the situation that the appliance expects 5v without negotiation. Naive consumers could get burnt for sure whenever exceeding 5v.

But it would be possible to implement a USB PD-compliant adaptor with the smarts to handshake, which would then refuse to complete the handshake in the event that the voltage supplied is not that requested. Of course it would be a bit strange to put that much sophistication into it which I suppose would drive the cost to that of a whole compliant PSU anyway (thus defeating the purpose). But notice the opposite has been done in a compliant manner, whereby the barrel adapter negotiates a USB voltage on behalf of a barrel device.

as there’s no way to communcate requirements through the barrel.

IIRC, it’s disputed whether the hanshake negotiation is needed for 5v. Some appliances expect to do a handshake /no matter what/, and some 5v appliances are designed to skip the negotiation entirely. If you are in the camp that says even 5v must have a handshake negotiation, then you would condemn the simple barrel to usb-c adapter (but perhaps not one that is only for a fixed input and the circuitry to do the negotiation).

Hard to blame USB for when we side-step it’s design.

The blame was not pin-pointed. I pointed out a shit show in the marketplace. There are bits of the standard you can blame (ambiguity and also having optional voltage steps), and you can also blame market actors. You can probably also blame regulators for not preventing the shit show that I described. And perhaps even blame consumers for not insisting that what they buy is tagged as USB PD complaint.

7

daveyOsborn @infosec.pub 4d ago

USB PD is also a shit show. You might want to read this:

https://goughlui.com/2025/12/01/tested-usb-c-barrel-connector-adapters-5-5mm-od-2-1-2-5mm-id/

Which shows those USB PD negotiations can get dicey. It chooses voltages thought to be close enough to what’s requested.

I’ve run into a nasty problem where a USB-C appliance needed 9v. Says in the manual something like “only use Kenwood power supplies on this device”. I thought, fuck that, USB PD is a standard for a reason. I’m not going to blow money on a proprietary OEM Kenwood USB-C PSU. Then found that many power supplies actually skip 9v. The USB PD standard makes some voltage steps optional, and some mandatory. IIRC, 9v was one of the required ones, yet it was easy to find USB-C power supplies that skipped 9v but offered 12v (or 15v, I forget). And yet 12v or 15v was one of the voltage steps that’s optional. And IIRC, the Kenwood OEM PSU /only/ did 9v, which is also not USB PD compliant, so the Kenwood PSU could not be used on other things.

So the USB PD strangely and arbitrarily makes some voltage steps optional, and manufacturers ignore the standard anyway.

I have an adapter that goes from barrel to USB-C. Recipe for disaster. Even if a 9v PSU uses that adapter and a USB-C appliance wants 9v, it will fry shit because any non-5v appliance expects to negotiate the voltage. I don’t recall how it leads to frying (I think b/c it tries to start at the 5v default before negotiating for 9v but instead it just gets hit with 9v), but the fact that there are USB-C-barrel adapters that just hardwire without the needed logic is scary.

daveyOsborn @infosec.pub 4d ago

So in the context of copious dumb users plugging in anything that fits the socket, the data PIN may¹ have prevented a lot of damage while at the same time enabled HP to rack in lots of money on replacement OEM proprietary PSUs. Indeed I have seen on many occasians clueless plebs at the street market selling 2nd-hand appliances and quickly trying barrels from a pile of tangled PSUs until one fits, then trying to include that with the device they are selling without looking at voltage or anything. It’s common and I’m sure lots of gear gets fried because the general population is just not smart enough.

I know how to match voltage, polarity, and current demands. And I got stung by the nannying to protect me from myself. Spent a lot of time disassembling a laptop, trying different RAM sticks, removing wifi cards and other components as I was baffled about what this fucking blicking LED means when it is not blinking in any way to convey an error code. Removed the CR2032 battery to reset the CMOS. Wondered if my slower than spec DDR3 RAM was causing this, so I went to the trouble of tracking down a RAM stick the precisely matched the specs. Still just got a steady non-stop blink, which the manual falsely states means it’s in sleep mode. So I was ready to conclude that the laptop was trapped in sleep mode and irreparably hosed. Perhaps I would have tossed a working laptop.

Whether it is a good design to protect from incorrect PSUs (despite that the obscure barrel connector is probably only 19.5v systems anyway), most certainly it’s a crappy design to not inform users. To fail to assign an error code. Sure, it vaguely says in the manual something like “use only approved HP power adapters” -- something /smart/ consumers do not take seriously because they know how to match PSUs to appliance and know that shit is always a branding hussle. The data pin should not be a secret that is concealed from both the user guide and the maintenance and service guide (which HP says is not for end users.. yet they still withhold the info from service people).

Perhaps good design as far as the PSU goes. But shitty to not document the situation and to not implement an error code.

¹ I stress /may have/ prevented damage because I have seen a lot of street market goods and only seen this obscure barrel tip on HP and Dell laptops, both of which are 19.5v.

daveyOsborn @infosec.pub 5d ago

Very happy to have learned about tildeverse.org. It gives a great refuge from a lot of the garbage. But I have to ask, if you are part of the tildeverse project why are you on lemmy.world, a centralised exclusive Cloudflare instance? I realise tildeverse does not have a lemmy node but there are many decent ones and LW is probably the most contrary to the tildeverse philosophies.

daveyOsborn @infosec.pub 5d ago

This definitely smells like a power problem, but we haven’t eliminated that your Dell PSU is actually fully functional yet, have we?

The Dell PSU has a white LED built into the cable end showing there is power -- a rare feature. That LED lights up with good brightness so I did not initially question the PSU. I just now attached a DMM which measured 300 mV. Another DMM measured 100 mV. So indeed the Dell PSU is bad.

Kind of a shame the LED is not designed to light up when ~19.5V is detected. I guess that might increase the cost too much.

Is your Dell PSU able to power up any other laptop successfully (with that laptop’s battery removed)?

I never used the Dell PSU before and have no other appliance for it. I happened to receive it along with other 2nd-hand stuff I bought. Thought I was lucky to have it once I came home with a laptop that needed it. None of my universal PSUs do 19.5v.. just whole numbers 19, 20, 21, etc.

Thanks for your feedback. Not sure how much longer I would have fiddled before deciding the test the PSU.

(edit) Now after insight from @over_clox@lemmy.world, I don’t know if the Dell PSU is broken. Perhaps the 3rd conductor which is used for data (to indicate brand-loyalty) is failing a negotiation. I wonder if it would send 19.5v if plugged into a Dell laptop.

(edit 2) correction-This diagram for HP’s connector is apparently the same as that of Dell. So my measurements (100—300 mV) were bad. Metering the outer and inner cylinder yield 20v using a cheap DMM and no load. So the Dell PSU works and is likely sufficient in terms of physics.

2

daveyOsborn @infosec.pub 6d ago

The Dell PSU I am using is 19.5v 3.34A. The reqs on the HP sticker are 19.5v 3.33A. I suppose that’s an exact match.. probably a question of whether they round up or truncate 3⅓A. I could buy an OEM HP PSU. On the big street market I go to it will be cheap enough, like 2 dollars. OTOH, I’ll be surprised if it makes a difference. I will just be wasting 2 dollars, I suspect.

daveyOsborn @infosec.pub 1w ago

Doesn’t stop it broadcasting, but stops it being useful to anything nearby.

Any SSID broadcast is useful to Google and Apple spies (read: simple phone patrons) who feed the SSID to the mothership which is then used for mapping. There are security risks by that alone even if it’s blocked from my LAN, which I detail in these threads:

Apart from tracking my residency, I boycott both Google and Apple, so I object to feeding them in the slightest even when it’s innocuous to me. The map data enhances their location products and feeds their advertising surviellance machines.

Anyway, I appreciate your insight. I assumed it was a proactive act by Karcher and would not have thought that they were naive or lazy w.r.t. something baked-in upstream from them.

1

daveyOsborn @infosec.pub 1w ago

What browser is that? Did you change a setting that would block redirections that would be triggered by the header Kairos mentioned in this thread?

daveyOsborn @infosec.pub 3w ago

You’re likening the ability of apple/Google to see devices moving around in Ukraine to someone figuring out who you are because you have a DAB radio transmitting an SSID and a MAC address - that only people within a hundred or so metres can see.

Of course. Apple does not distinguish a DAB radio from a smartphone from an access point. It just blindly collects all SSIDs and MACs. Why do you think a soldier in Ukraine would get not only different treatment, but in fact more compromising treatment? That’s absurdly unrealistic. It costs Apple money to pay engineers to write tailored code and filters that then get deployed to all iOS devices at the risk of the exceptional logic doing the wrong thing. Of course iOS devices indiscriminantly send all data just the same.

The Ukraine soldier tracking was a scandalous embarrassment, so it stands to reason that adjustments have been made since then -- and most likely by Ukraine not Apple. But if it were Apple, the change would obviously be to /not/ collect the compromising data of soldiers. A war fighter has a higher expectation for privacy than a DAB radio listener.

It’s not Apple who tracked the Ukrainian soldiers. The exploit was demonstrated by an end user who was simply making use of available data from Apple. IOW, some avg. Joe tinkering in their basement could do it. And they could do it with LESS information to start with. The person who demonstrated the tracking was much further than 100 meters. They were not even in Ukraine IIRC. They did not know where the soldiers were to begin with (IIRC). Unlike a Karcher scenario, where an adversary could very well have the victim’s starting location. It’s trivial track the victim from there in this case.

Again, I bring you back to the test laid out by the EDPB. For indirect identifiers like this to be considered personal data you have to consider the technical ability and the liklihood of someone converting that indirect identifier into something that actually identifies you as a natural person.

Do stalker victims have to prove the likelihood that their threat agent will attack? It’s already clear to me that the GDPR is mostly a failure. If judges and GDPR practitioners were to require proof that excessive data would likely lead to misuse as a precondition to corrective action against art.5-1(c) infringements, it would be yet another failure of the GDPR. The whole point to Art.5-1(c) (data minimisation) is to improve privacy generally without anticipation of particular threats. That’s the whole point of it. What you suggest is a purpose-defeating abuse of interpretation and discretion.

But in the real world, I don’t believe you do. You mention a stalker - a stalker isn’t going to find you by driving around using a WiFi scanner looking for a DAB radio.

If I ever have a stalker, I hope they are as unmotivated and undevoted as you suggest. But I have to say you have a strangely optimistic or flippant view of the psychology of a stalker.

2

daveyOsborn @infosec.pub 3w ago

But a DAB radio? Like others have said,

Others? You mean the person who thinks data is only collected by product registrations? Who thinks “smart” devices have no GDPR relevance? And who thinks MAC addresses are not unique and who also thinks a MAC address on a DAB radio can be changed by consumers apparently without breaking an anti-reverse engineering terms of use? Who also thinks Karcher would become GDPR compliant through a MAC changing mechanism if it were to exist. Who then tried to establish credibility by claiming to endorse the GDPR. Indeed.. not a good source.

unless you registered it under your name then its MAC is not linked to you.

You cannot really know what Google and Apple do with their data collection as opaque as they are. But the data is there. They have enough to link people to MAC addresses on a large scale in an automated fashion. The data collection is proven by Douglas Leith’s research.

At the same time, we need not rely on assumptions. I could unwittingly place my Karcher within view of my front window while my neighbors who know exactly who I am. I might also be the sole person in hundreds of meters who has a Karcher that emits a unique MAC address. Any arbitrary owner of a Karcher radio would not necessarily even be aware of the reckless emissions. My neighbor would realistically have a great degree of certainty that the MAC address relates to me as they can see the signal strength increase ast they approach my dwelling and decrease as they walk away from it.

To make this more interesting, replace “neighbor” with “stalker” in the above paragraph. Then when I move to get away from the stalker, the DBs of Apple or Google could reveal¹ my new location. Or the stalker can war drive if they know I didn’t move far.

¹ Note that research showed that Ukranian troops were trackable using Apple’s map tool that all ordinary Apple consumers have access to.

1

daveyOsborn @infosec.pub 3w ago

Once again “personal data.” You haven’t told us how Karcher knows that the device belongs to you. Everything else is irrelevant.

Nonsense. Karcher doesn’t need to know /who/ the personal data belongs to in order to be accountable for designs that violate Art.25.

Local storage is subject to GDPR if: The organization maintains control … The data is personal

Did you log on the device using an email or any personal data? You have to consult a lawyer for that because I doubt you fall in that case.

wtf, stop making up quotes.

A MAC address is unique

Absolutely not, and it can be changed.

Citation needed. Karcher does not even allow users basic access to change the SSID. Please point to the page in the Karcher user guide showing how to change the MAC address on their appliance.