[Ajedi32]

Good idea. Though that can also be bypassed rather easily by including a small battery in the malicious device and only drawing the expected amount of power from the USB connection itself.

The real solution needs to be some sort of standardized auth system, where devices are identified by a public key rather than a static serial number. In the absence of that though, I think whitelisting serial numbers is the next best thing. It'll slow down attacks at least, and open the door for future improvements to the system.