I'm concerned about USB devices being physically attached to my MacBook laptop when I am about to unlock my computer or while my computer is unlocked.
My threat model involves an attacker who is willing to spend about $200 to gain access to my laptop, in particular my own user account or root. So, sophisticated physical attacks such as complicated hardware modifications or physical laptop replacement are not possible.
But I'd like to be able to:
Leave my computer unattended but locked for a few minutes while I use the bathroom at a coffee shop.
Plug-in external USB storage devices without having to boot into an isolated VM or use a guest user account. Be able to charge my phone from the USB port using an untrusted cable and still be able to use my computer from my user account at the same time. Be able to use untrusted external monitors through USB.
Avoid having to physically touch my USB ports to make sure nothing nefarious is connected before I type login.
The attack I'm worried about is obviously BadUSB or customly designed USB devices that can act like keyboards (and can be produced for less than $200). These devices could be plugged in while I leave my laptop unattended, and can possibly be too tiny (think ubikey size) to be immediately noticed. Or they could be plugged in by a person sitting next to me when I show them something on my screen.
I already employ basic opsec practices, including FDE, a firmware password, a user account password that changes often, always locking my computer when I am away, no password reuse, running only binaries I trust etc.
The solution I am thinking of would be along the lines of having to "authorize" new USB devices when they are plugged in; and I should be able to view their type (e.g. keyboard VS camera VS microphone VS charging cable VS storage device). If I authorize a USB device and it is unplugged and re-plugged, I should be given the option to re-authorize it or to unauthorize it, and it shouldn't be able to act until I make the decision. And if a device tries to re-register as a different type, it should be blocked until authorized.
Do you know of a system that allows me to do that? Thanks!