Dangerous new trend in USB key marketing from companies

[ataradov]

VID is just a number, you can't copyright numbers.There is absolutely noting they can do here.

[Brumby]

Something is identified as Apple - by whatever means - and that is not a trademark issue?

Having trouble seeing that.

[ataradov]

Something is identified as Apple - by whatever means - and that is not a trademark issue?
Having trouble seeing that.

  It did not identify as Apple. Linux matched its USB Vendor ID to a database and printed Apple. It is not device's fault. The device itself identified as :

Code: [Select]

[14750.121605] usb 3-2: Product: WEBKEY
[14750.121607] usb 3-2: Manufacturer: ŵࠅę̩ʑ֕


[Brumby]

Then I'm curious as to how it picked out Apple.

[ataradov]

What "it"? The device picked a "random" number. In this case it ended up being 0x05ac. The fact that Linux comes with a text file matching this number to a string "Apple" is a pure coincidence.

USB requires VID/PID to work, and USB IF does not make it easy to get them. So people just put random numbers.

[xaxaxa]

USB requires VID/PID to work, and USB IF does not make it easy to get them. So people just put random numbers.

Or spoof a specific VID/PID, which I had to do in one of my products, otherwise windows will not recognize it as stupid windows has no concept of "device class" but rather ties drivers to VID/PID.

[perieanuo]

USB requires VID/PID to work, and USB IF does not make it easy to get them. So people just put random numbers.

Or spoof a specific VID/PID, which I had to do in one of my products, otherwise windows will not recognize it as stupid windows has no concept of "device class" but rather ties drivers to VID/PID.

yep, can do this, but here you can got yourself a big nice copyright lawsuit.why not buy original ftdi and use it as it is with his original vid/pid...
we made products like you did with some pid/vid different from original and build own drivers.
but wat the hell maybe I'm missing something
regards,pierre

[bd139]

I think people who build their own drivers and get IDs changed should be shot because it's a PITA getting the generic drivers working on MacOS X then. 

[edy]

The list of USB VID's is here:

http://www.linux-usb.org/usb.ids

Scroll down to 05ac  Apple, Inc., you will see lots and lots of PID's associated with various Apple products. I assume that this vendor ID is reserved for Apple use only, so as they add more products they can fill in their PID's as needed. Note that this WEBKEY uses an unpopulated PID 6662. Apple doesn't use it, *yet*. They end at about 1500 and then jump to 8005 in the list.

Linux doesn't know, and I doubt that in the future Apple will just "Release" a subset of their VID PID's to another company. So they *are* infringing on what seems to be a reserved Apple range of PID's... certainly by claiming to be them as a vendor for sure, and then in the future potentially conflicting with something Apple may release. They should not have used that VID, regardless of what PID they are using (even though Apple doesn't currently have anything listed). One other note.... I do not know if this Linux-USB list is comprehensive (probably not) and so there must be a USB consortium or some other organization that handles this... i.e. here:

https://www.usb.org/getting-vendor-id

There-in lies the potential legal ramifications... the company could potentially be sued by USB.org. They also have tools here: https://www.usb.org/usb2tools, and there is a Company list you can download if you are a member (maybe someone on the forum is and can check the relevant codes and rules). Anyways, like I said before it seems that if you make USB devices you probably need to comply to this organization's rules but it may be "suggested" and not legally enforceable (and I doubt the law extends to China which seems to do whatever it wants anyways).

[ataradov]

So they *are* infringing on what seems to be a reserved Apple range of PID's... certainly by claiming to be them as a vendor for sure, and then in the future potentially conflicting with something Apple may release.

It is not an infringement in a legal sense. In order to use USB peripheral in a microcontroller, you don't have to know about the list of existence of USB IF.

There-in lies the potential legal ramifications... the company could potentially be sued by USB.org.

No, they can't. Unless it is a frivolous lawsuit.

It is a contractual issue. They can be used for contract violation (as those companies that tried to resell PIDs). But if they have not entered into a contract in a first place, they can't be sued for violating it.

USB IF can pursue copyright infringement if you use their logo on the product. But that's it.

BTW, everyone is "infringing" whey they use I2C addresses, since NXP maintains a list of officially assigned addresses.

[Bassman59]

Then I'm curious as to how it picked out Apple.

Simple. The Manufacturer ID is a string stored in the device and returned to the host during enumeration.

[ataradov]

This is not the case here. Manufacturer ID string is not Apple here.

[edy]

I had some time so I put together a video summarizing this thread for others to watch and hopefully learn about this terrible practice. Maybe somebody from Colgate or Apple will see this and take notice!



DESCRIPTION:

I received this marketing material from Colgate and in the package was this plastic card with a flip-out USB key that I thought was a USB drive with Colgate brochures/videos. Instead, the device turned out to be a keystroke injector, taking over the keyboard input to launch a browser on your computer. This is a sneaky and dangerous practice, susceptible to hacks and total waste!

The URL it types is 25 characters, but can be entered only as 17 characters (srt.red/CAEnglish) without the "https://", and if they shortened it more could easily be 10 (srt.red/CE) as they can control the bitly shortcut. They could have just printed in big letters to go to "srt.red/CE" (English), or "srt.red/CF" (French) or "srt.red/US" (USA) instead of making this useless piece of garbage that causes issues on Linux machines, has the potential to mess up your system and does stuff you don't expect!

At least if they provided a useful USB Storage Drive (e.g. 16GB) with their name on it, it would have some utility and more impact. Instead, this promo material is used once and trashed! It only shows how ridiculous marketing is getting and I am sure Colgate is unaware or doesn't know this is bad practice or likely to leave a negative impression.

[Richard Crowley]

It is extremely unusual to have more than one keyboard attached to a computer,

That is completely contrary to my experience.  Windows at least will happily accept any kind of HID (Human Interface Device) and automatically install drivers (if necessary), etc.  Keyboards and Mice are only two types of HID.  Many other types are in wide use. For example, barcode readers, RFID readers, etc.

so IMHO the USB drivers should realise that you already have a keyboard and prompt whether to enable them when subsequent ones appear.

Lots of dumb users would find it annoying to have to click through several authorization windows just to plug in their mouse.  There probably isn't much difference to the OS between a keyboard and a mouse.

For years, we have seen movies and TV where the good guy (or the bad guy) sneaks in and plugs in a USB gadget to copy all the secret files or give remote access to the controllers out in the panel van on the street, etc.