You’ve taken the first steps into taming the beast. Respect is due, but keep deepening your understanding of how those things work, right down to the individual steps, so you can better prevent yourself being taken advantage of.
Like, if you can explain a concept without using any jargon or “buzz-words”, then it shows you truly understand it
So just to clarify, you don’t want to use the internal keyboard and trackpad? It’s fine if you don’t, but just wanted to check.
Well, let’s have a think about what is actually happening when you plug in a wireless keyboard.
You’re introducing a wireless antenna as a USB device into your machine that parses incoming radio waves from “another entity” and converts them to USB HID keystrokes via its USB plug to your Librem’s USB controller.
This wireless antenna USB device may or may not be pre-programmed to do other things, including things that might not be immediately apparent to the end user (that’s you).
The danger doesn’t lie in the fact that it’s “wireless”. That danger lies in the way the device operates, what protocols it uses, and how those protocol could potentially be exploited to get the device to do something that it shouldn’t be doing.
You have to consider this:
- Do you know for a fact that this USB wireless receiver will only accept requests from your keyboard and nothing else? (The answer is NO, unless you built it yourself)
- A keyboard from the guy next to you while you’re travelling?
- A spoofed keyboard (this is not hard to do with a computer and any wireless antenna, once you figure out how that peripheral communicates, and how to send it similar commands)
- A backdoor in the firmware (suddenly the USB dongle tells your laptop that it’s also a wifi antenna, and your computer acknowledges and uses it to connect to an attacker’s ad-hoc network)
- Do you know that communication between the keyboard and dongle is encrypted?
- You’d be surprised at how many are not… usually the cheap ones are not
- Is it encrypted both ways? (If an attacker knows when you’ve got your Caps Lock on, that information can be useful in some attack scenarios)
- If it is encrypted, does every single device in that model class use the same encryption keys? (Most likely, yes, unfortunately… and then BOOM, the guy sitting next to you with the same dongle now knows your password
)
- If it is encrypted, can I add my own custom encryption key? (The cheap ones usually don’t have any software/firmware that allows this to happen, so unless you are prepared to “get your hands dirty”, “pop the hood” of the device and hack your own encryption key into it, the answer is likely no)
- You’d be surprised at how many are not… usually the cheap ones are not
If these are all things you’re prepared to accept, then happy days. But most people who understand this would unlikely be willing to accept this
Your assumption that a keyboard is just “a keyboard” is what’s tripped you up before
But hey, you’ve taken your first step into a larger world. Welcome!