USB vulnerabilities are widely exploited. It's used against journalists, activists, dissidents and others at border crossings, protests and elsewhere. Android 16+ has opt-in protection but it's far weaker than our default and blocks installing apps from outside the Play Store.

USB vulnerabilities are widely exploited. It's routinely done against journalists, activists, dissidents and others at border crossings, protests and elsewhere. Android 16+ has opt-in protection but it's much weaker than our default and tied to blocking installing apps from outside the Play Store...

USB vulnerabilities are being widely exploited. It's done as a routine thing against journalists, activists, dissidents and others at border crossings, protests and elsewhere. Android and iOS have obscure opt-in settings to block most of the attack vector. We have better protection on by default.

@nprofile1q... You can see many of the replies at https://nitter.net/linuxuser1996/status/2086757738055389637. We wrote several responses and copy-pasted those to dozens of the replies. Most of the people who replied said they have the feature on their standard Android device when they don't. They believe the standard Android USB menu is the same thing when it isn't at all. Android Advanced Protection Mode added in Android 16 is similar to the software part of our feature but not as good and it's missing the hardware-level blocking.

@nprofile1q... You can see many of the replies at https://nitter.net/linuxuser1996/status/2086757738055389637. We wrote several responses and copy-pasted those to dozens of the replies. Most of the people who replied said they have the feature on their standard Android device when they don't. They believe the standard Android USB menu is the same thing when it isn't at all. Android Advanced Protection Mode in Android 16 is similar to the software part of our feature but not quite as good and it's missing the hardware-level blocking.

@nprofile1q... @nprofile1q... Setting it to Off disables USB including charging in the regular OS boot mode.

It will still charge in the special OS boot modes: charging, recovery, fastbootd and rescue. Charging mode is what boots when you plug the device into a charger while it's turned off and shows the battery percentage on the screen.

It can also still charge while powered off and in the firmware boot modes: fastboot mode and boot ROM recovery mode.

It can't brick the device.

@nprofile1q... Yes, it has all of the USB peripheral functionality enabled. You can also plug in a display and it will connect to it, although current Android will prompt before mirroring the screen to it.

Android's main USB menu only controls the USB gadget mode and has nothing to do with the device Android is running on using USB peripherals itself. iOS works similarly.

Many users misunderstand Android's standard approach.

See the replies to https://x.com/linuxuser1996/status/2086757738055389637 for why we posted this thread.

@nprofile1q... Yes, wireless charging still works with the USB-C port mode set to Off. Setting it to charging-only provides most of the security value but we decided to offer the ability to fully disable it in case there are ever USB-PD vulnerabilities in the USB controller. USB-PD is a secondary form of limited data which could be used to exploit the USB controller itself, turn on USB data and then reach the remaining attack surface for USB in the kernel despite drivers being off.

GrapheneOS blocks new USB connections while locked by default at both a software and hardware level. It can be enabled while unlocked too. It can even be set to fully disable USB while booted including USB-PD and other charging functionality. More info:

https://grapheneos.org/features#usb-c-port-and-pogo-pins-control

Standard Android USB charging-only mode does not block new USB connections. It only means the device Android is running on isn't acting as a USB peripheral such as a webcam, MTP or MIDI device itself. USB debugging is another of those gadget modes which can be on simultaneously.

Android 16 added Android Advanced Protection Mode which can be used to toggle on multiple extra security features. It blocks new USB connections at a kernel level while the device is locked. Our approach also blocks new USB connections at a hardware level and disables USB data.