Hacker News new | ask | show | jobs
by messe 2439 days ago
> Bluetooth [is] disabled in OpenBSD for security

A clarification on that point: OpenBSD's bluetooth stack was unmaintained and removed due to code rot; it's not that bluetooth as a protocol is inherently insecure.

2 comments

> it's not that bluetooth as a protocol is inherently insecure

Bluetooth is a ridiculously complex protocol. Complexity is the enemy of security. There's no fixed threshold beyond which complexity makes something "insecure", and Wi-Fi and even USB aren't exactly simple (both have had their share of implementation exploits across operating systems), but AFAIU there's a strong sentiment that Bluetooth is far too complex for the benefit it brings, which perhaps explains why OpenBSD's stack was unmaintained.

Course, now we have Bluetooth: Wired Edition with USB-C layering many different optional protocols over the base transport. I understand the rationale, but I fear it means the days of "just works" USB may be coming to an end...
Here's a list of Bluetooth security problems according to NIST: https://twitter.com/dchest/status/952981861080461312 (full PDF: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpubli...)