USB port blocker

[_act_]

One of the safest method of having a secure wallet is the use of airgapped devices. If an airgapped device has camera, all needed is the use of QR code and the camera for the transfer of PSBT and signed transactions and nothing more than that. Which means after the device OS has been installed again and the wallet has been created on the airgapped device, the device does not need to connect to the internet or other devices again. If the Bluetooth and WiFi card have be removed, what about the USB port?

I found out online that USB port locker can be used. I saw these two videos on YouTube:

https://youtu.be/q1L3lCDVZUg?si=mLgi0uYnk6MHdI-s
https://youtu.be/BEtOV7RVK6s?si=vEUt2D9GbDbBOnGf

If this USB port locker is bought and used to lock the USB ports, is it like the house door keys that if another locker is used with the locked USB Port, the port will not be unlocked until the right one used to lock it will be the only one that can unlock it? Or are there ways attack can be able to remove the locker in a way the USB port will not be damaged?

Or is it just a waste of time in a way that the locked USB port can be removed and replaced by new one?

Is it worth buying?

[DaveF]

Waste of money.

1) For a desktop PC all you have to do is pop the top and add in a USB card.
2) They are still plastic, with time and effort you can pull one out.
3) For the determined person it's get laptop, take off cover, un-solder the port (only 4 wires on USB 2) and solder in a new one. But at that point you might as well just pull the drive out

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

-Dave

[philipma1957]

Waste of money.

1) For a desktop PC all you have to do is pop the top and add in a USB card.
2) They are still plastic, with time and effort you can pull one out.
3) For the determined person it's get laptop, take off cover, un-solder the port (only 4 wires on USB 2) and solder in a new one. But at that point you might as well just pull the drive out

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

-Dave

yeah bios and password lock would be best way and cost is zero.

[hugeblack]

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

This is the best method, but I prefer to have a port for an SD card or even a USB. Sometimes, there is a need to transfer PSBT files, or there are large signatures for which a QR code cannot be created due to the lack of enough space.

Hardware wallets feature a secure element, so instead of spending money on a locked USB port, purchasing a hardware wallet with a secure element and creating a multi-signature wallet will greatly enhance the security of your coins.

[virasog]

Is it worth buying?

Not really, it will just add an extra cost while the same can be protected through free methods.

First of all, your airgapped device should be password protected. Since no one can access that device without the password, no one can use the USB on that device and you yourself won't use it too. Spending money on buying the USB port blocker is not worth it.

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

Apart from this, the USB ports can be disabled in the computer too through "Device Manager" if you are using the Windows Version.

[_act_]

This is the best method, but I prefer to have a port for an SD card or even a USB. Sometimes, there is a need to transfer PSBT files, or there are large signatures for which a QR code cannot be created due to the lack of enough space.

This is the first time I am hearing about this because QR code has not failed me before. What do you mean by large signature?

Hardware wallets feature a secure element, so instead of spending money on a locked USB port, purchasing a hardware wallet with a secure element and creating a multi-signature wallet will greatly enhance the security of your coins.

I did not know that I can be able to lock and unlock the USB board using password on the laptop, it would be best for what I am looking for. When I have old laptop, I do not see a reason I should get a laptop. I may buy hardware wallet.

Apart from this, the USB ports can be disabled in the computer too through "Device Manager" if you are using the Windows Version.

I saw it under universal serial bus controller which can be found under device manager.

[_act_]

I think he refer to either,
1. Transaction with many inputs.

If a transaction is containing many inputs, the transaction virtual size can be high but the signature is just one. Or is that wrong? Or is the high size of the transaction that result to the issue?

2. Transaction which spend input which require to reveal long script or contain many signatures.

Did you mean transactions that are broadcasted using a multisig wallet? If it is multisig, I do not use it as a multisig but as a single signature wallet.

[LoyceMobile]

If you're worried about physical access to your hardware: use glue! Second hand laptops are cheap enough to be expendable. Fill the ports, glue the memory, glue the lid, make it a lot of work to open it without turning it off.

As paranoid as I am, even I haven't done this. Yet.

[ABCbits]

I think he refer to either,
1. Transaction with many inputs.

If a transaction is containing many inputs, the transaction virtual size can be high but the signature is just one. Or is that wrong? Or is the high size of the transaction that result to the issue?

With P2PK, P2PKH, P2SH-P2WPKH and P2WPKH, 1 input always require 1 signature. But on P2TR and depending on spend condition, you could utilize signature aggregation where many inputs only require 1 (aggregated) signature.

2. Transaction which spend input which require to reveal long script or contain many signatures.

Did you mean transactions that are broadcasted using a multisig wallet? If it is multisig, I do not use it as a multisig but as a single signature wallet.

Multisig is just one of the example. Anyway, since the original concern is about size of PSBT, you could just check example on BIP 174[1] to see how long PSBT data could be.

[1] https://github.com/bitcoin/bips/blob/master/bip-0174.mediawiki#user-content-Test_Vectors

[Kryptowerk]

Waste of money.

1) For a desktop PC all you have to do is pop the top and add in a USB card.
2) They are still plastic, with time and effort you can pull one out.
3) For the determined person it's get laptop, take off cover, un-solder the port (only 4 wires on USB 2) and solder in a new one. But at that point you might as well just pull the drive out

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

-Dave

Correct me if I'm wrong, but isn't the easiest way to reset a BIOS password still to just remove the mainboard battery? Or was that only possible 20 years ago and things have changed? not up to date, but most likely BIOS pws are still quite easy to circumvent I would guess.

[LoyceMobile]

]Correct me if I'm wrong, but isn't the easiest way to reset a BIOS password still to just remove the mainboard battery? Or was that only possible 20 years ago and things have changed? not up to date, but most likely BIOS pws are still quite easy to circumvent I would guess.

Any half decent BIOS password can't be reset (anymore) by removing the battery.

[DaveF]

Waste of money.

1) For a desktop PC all you have to do is pop the top and add in a USB card.
2) They are still plastic, with time and effort you can pull one out.
3) For the determined person it's get laptop, take off cover, un-solder the port (only 4 wires on USB 2) and solder in a new one. But at that point you might as well just pull the drive out

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

-Dave

Correct me if I'm wrong, but isn't the easiest way to reset a BIOS password still to just remove the mainboard battery? Or was that only possible 20 years ago and things have changed? not up to date, but most likely BIOS pws are still quite easy to circumvent I would guess.

Depends on the machine. Older ones yes, newer ones no.

With the next being said, if you are doing that then you have to power down and reboot the machine. At which point when it reboots.
If you had your drive encrypted then they can't get to it now anyway.
And, if you didn't have it encrypted. Then they powered down your machine and got the battery....they can just take your drive.

Any half decent BIOS password can't be reset (anymore) by removing the battery.

Keep in mind most of these are going to be on older machines so we are not taking 2023, but 2016....

-Dave

[philipma1957]

Waste of money.

1) For a desktop PC all you have to do is pop the top and add in a USB card.
2) They are still plastic, with time and effort you can pull one out.
3) For the determined person it's get laptop, take off cover, un-solder the port (only 4 wires on USB 2) and solder in a new one. But at that point you might as well just pull the drive out

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

-Dave

Correct me if I'm wrong, but isn't the easiest way to reset a BIOS password still to just remove the mainboard battery? Or was that only possible 20 years ago and things have changed? not up to date, but most likely BIOS pws are still quite easy to circumvent I would guess.

A lot depends on the pc case and how well it is secured.

A usb lock you paid for and stuck in a case can pretty much be pulled out with a pliers in about 1 minute.

It is visible and easy to attack it with this

https://www.amazon.com/Wiha-32623-Bent-Pliers-Cutters/dp/B000T9XU8Q/ref=sr_1_23?

[DubemIfedigbo001]

Waste of money.

1) For a desktop PC all you have to do is pop the top and add in a USB card.
2) They are still plastic, with time and effort you can pull one out.
3) For the determined person it's get laptop, take off cover, un-solder the port (only 4 wires on USB 2) and solder in a new one. But at that point you might as well just pull the drive out

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

-Dave

well said, an experienced engineer will just loose the computer system, remove the hard drive, use original operating system if its windows10 and attempt repairing the OS, then using command prompt to bypass the password and gain access to the information on the hard drive and the rest is history. Even if you used an application to protect your wallet, it will just be uninstalled, and the rest is history. your computer and the airgap will be there for you unharmed, but your coins are gone.

In conclusion, this approach suggested by OP is just a total waste of money.

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

BIOS settings can be reset by removing the CMOS battery, then plugging the PC. A better way is even replacing the BIOS chip with a spare from a similar Board. it only takes few minutes to execute. you just pray and believe you're not a target cos there are many ways to breach the assumed security.

[m2017]

~snip
BIOS settings can be reset by removing the CMOS battery, then plugging the PC. A better way is even replacing the BIOS chip with a spare from a similar Board. it only takes few minutes to execute. you just pray and believe you're not a target cos there are many ways to breach the assumed security.

Trick with removing the CMOS battery doesn't always work.
You are not proposing the simplest solution to replacing the BIOS chip. This process will probably take more than 5 minutes, because you will need to gain access to the board with the chip. For example, on laptops. Sometimes may need to go through nine circles of hell to get to the motherboard without damaging anything. Here you can add a solution with flashing the BIOS using a programmer, instead of replacing a BIOS chip of an identical model from the exact same motherboard (which still needs to be found).

In general, your message is correct - you should not rely entirely on a password-protected BIOS to block the USB. You can always find a solution to get around this (any) obstacle. It's just a matter of resources spent.

[DaveF]

And this also brings home the point of why you should be using VeraCrypt or something similar https://www.veracrypt.fr/en/Home.html
Take my PC, remove the drive, you are still not getting anything out of it.

Use whatever metaphor you want be belt and suspenders, screw and glue, whatever. BIOS boot password, drive encryption password, OS encryption password.
But, once again only if its really worth it. Don't spend $200 of time to protect $50 of crypto.

-Dave

[philipma1957]

And this also brings home the point of why you should be using VeraCrypt or something similar https://www.veracrypt.fr/en/Home.html
Take my PC, remove the drive, you are still not getting anything out of it.

Use whatever metaphor you want be belt and suspenders, screw and glue, whatever. BIOS boot password, drive encryption password, OS encryption password.
But, once again only if its really worth it. Don't spend $200 of time to protect $50 of crypto.

-Dave

Yeah if you have value say 2 btc it is worth being on its own pc backed up with seeds yada yada yada. and you only use that pc for 1 thing your btc wallet.



and have say 0.1 btc and some shit coins on a less secure setup of pc+phone+exchange.

Back in the day in New York City the 1970's.

 I used to carry:
 a wallet with some cash say 20-35 bucks
 a money clip with more cash say 80-120 bucks
 a hidden pocket with more cash say 300 to 400 bucks

[NeuroticFish]

I like a lot the simple solutions proposed here, from gluing to VeraCrypt.
However, there's one more option people tend to underestimate. And imho it's cheap and very easy, especially nowadays when computers tend to no longer be connected to UTP cables (if you use permanent connection via cable, just skip this post).

Boot from an USB stick with Tails OS. Electrum is there and persistence is off. Yes, one will have to enter the 12-24 words every time, not such a big hassle imho (of course, as said, this is not for safeguarding 10$). It doesn't know what's your WiFi so it cannot connect online.
The seed can be stored easily and safely in so many ways it just depends on each and everyone's imagination.

One can steal your computer and will find only the watch only wallet. One can steal the live OS stick and also find nothing. And it's also cheap, since one doesn't necessarily need another computer for this.

Of course, if one wants and can use a separate computer as cold storage, probably VeraCrypt beats this.

[LoyceMobile]

One can steal your computer and will find only the watch only wallet. One can steal the live OS stick and also find nothing. And it's also cheap, since one doesn't necessarily need another computer for this.

The back and forth copying of unsigned and signed transactions is cumbersome though, especially if you make a mistake (for instance with fees, or use an incompatible version of Electrum), and have to reboot a few times. I'm speaking from experience.

[ABCbits]

And this also brings home the point of why you should be using VeraCrypt or something similar https://www.veracrypt.fr/en/Home.html
Take my PC, remove the drive, you are still not getting anything out of it.

Some Linux distro even let you encrypt the disk during installation process which is far more simple than configuring VeraCrypt or LUKS post installation.

Boot from an USB stick with Tails OS. Electrum is there and persistence is off. Yes, one will have to enter the 12-24 words every time, not such a big hassle imho (of course, as said, this is not for safeguarding 10$). It doesn't know what's your WiFi so it cannot connect online.
The seed can be stored easily and safely in so many ways it just depends on each and everyone's imagination.

That's valid option. Although depending on your device, you may face known issue (https://tails.net/support/known_issues/index.en.html) which is tricky to deal with. And as @LoyceMobile said, outdated Electrum could be problematic on few cases. Although these days we have PSBT which cut-off many incompatibility problem.

[DaveF]

Yeah if you have value say 2 btc it is worth being on its own pc backed up with seeds yada yada yada. and you only use that pc for 1 thing your btc wallet.


and have say 0.1 btc and some shit coins on a less secure setup of pc+phone+exchange.

Back in the day in New York City the 1970's.

 I used to carry:
 a wallet with some cash say 20-35 bucks
 a money clip with more cash say 80-120 bucks
 a hidden pocket with more cash say 300 to 400 bucks

 a wallet with some cash say 20-35 bucks  -> Phone with hot wallet
 a money clip with more cash say 80-120 bucks -> PC with some basic security
 a hidden pocket with more cash say 300 to 400 bucks  -> Hardware wallet
 Everything else you left in a secure location like a safe -> 2nd hardware wallet that only the people that need to know actually know about.

Side note, I know someone who created one of those fake scam wallets that are floating around, and it's on her PC that is the one she uses for day to day stuff. So if someone knows she has crypto, and gets to that PC to get the wallet.dat file they are actually getting a figment of her imagination.

-Dave

[NotATether]

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

Only the BIOSes for enterprise computers have that I think, like hp pro and Dell Optiplex. I have never seen such an option to disable the USB ports on BIOSes for consumer desktops or laptops. Also I think it's a relatively new setting so it probably won't be on some workstation from 2008.

[DaveF]

Most if not all PCs can disable the USB ports in BIOS and you can also set a BIOS password so that cannot be changed without the password.

Only the BIOSes for enterprise computers have that I think, like hp pro and Dell Optiplex. I have never seen such an option to disable the USB ports on BIOSes for consumer desktops or laptops. Also I think it's a relatively new setting so it probably won't be on some workstation from 2008.

It's been around since at least 2011. So we are talking PCs that are 12+ years old at this point.




The problem you run into is that the PC has to have the PS/2 port 6-pin mini-DIN ports. Otherwise when you disable the USB then you don't have a keyboard.
Makes it REALLY hard to do stuff. So if you don't have the PS/2 ports a lot of times the bios does not give that option.

Sometimes is does have the option of only allowing USB for keyboard / mouse but that has it's own security implications.

-Dave

[stompix]

What's the point of these devices?
As far as their description, they would prevent connecting Pen Drives, Tablets and other USB to your computers....

Am I just stupid to not understand this but how is a stranger going to force his way to your computer, and how is a piece of plastic going to stop him?
- laptop in a cafe, that guy is going to run away with the damn laptop not do a 007 while you're farting your frappucino in the bathroom
- computer at home, so after breaking your door, stealing your watches and jewelry he will sit down, open your computer, perform a malware scan so his own malware is effective and then leave quietly and not touching your wallet at all.

Phil mentioned a set of pliers, but forget those one $10 wrench in the hand of a 120kg guy and you're going to undo every encryption yourself in seconds and that usb port is going to be the last hole you're worried about.

[DaveF]

What's the point of these devices?
As far as their description, they would prevent connecting Pen Drives, Tablets and other USB to your computers....

Am I just stupid to not understand this but how is a stranger going to force his way to your computer, and how is a piece of plastic going to stop him?
- laptop in a cafe, that guy is going to run away with the damn laptop not do a 007 while you're farting your frappucino in the bathroom
- computer at home, so after breaking your door, stealing your watches and jewelry he will sit down, open your computer, perform a malware scan so his own malware is effective and then leave quietly and not touching your wallet at all.

Phil mentioned a set of pliers, but forget those one $10 wrench in the hand of a 120kg guy and you're going to undo every encryption yourself in seconds and that usb port is going to be the last hole you're worried about.

More or less to prevent attacks from these kinds of devices: https://shop.hak5.org/products/usb-rubber-ducky
If you come after me with a $5 wrench it's all known and there really is not much that can be done.
If you deploy a payload with one of those devices it could be a lot more difficult to figure out what the hell happened. And how to stop it from happening again.

-Dave

[virasog]

Boot from an USB stick with Tails OS. Electrum is there and persistence is off. Yes, one will have to enter the 12-24 words every time, not such a big hassle imho (of course, as said, this is not for safeguarding 10$). It doesn't know what's your WiFi so it cannot connect online.
The seed can be stored easily and safely in so many ways it just depends on each and everyone's imagination.

That's valid option. Although depending on your device, you may face known issue (https://tails.net/support/known_issues/index.en.html) which is tricky to deal with. And as @LoyceMobile said, outdated Electrum could be problematic on few cases. Although these days we have PSBT which cut-off many incompatibility problem.

Well, when i read these Known issues, the most common one is "Tails not starting at all", this won't be a problem for us because we are not making tails persistence storage. So if somehow your tails USB is unable to load the OS, becomes corrupt etc, you can reinstall tails to the same or a new USB.

Secondly, the Tails OS do not come up with an updated Electurm version but we can download the Electrum Appimage for Linux from https://electrum.org/#download and copy this image through the USB to the Tails. The tails remain airgapped as we never enable the Internet on Tails.

[Joeyp]

If you have just some BTC in your wallet, simple hardware wallet will be ok. You can also look in expert level here - https://sparrowwallet.com/docs/best-practices.html. USB port locking software - https://www.gilisoft.com/product-usb-lock.htm - ~0.0019 BTC/lifetime.

[ABCbits]

--snip--

Well, when i read these Known issues, the most common one is "Tails not starting at all", this won't be a problem for us because we are not making tails persistence storage. So if somehow your tails USB is unable to load the OS, becomes corrupt etc, you can reinstall tails to the same or a new USB.

Secondly, the Tails OS do not come up with an updated Electurm version but we can download the Electrum Appimage for Linux from https://electrum.org/#download and copy this image through the USB to the Tails. The tails remain airgapped as we never enable the Internet on Tails.

But,
1. If you bother read Tails documentation further, there's also different page dedicated about issue related with graphic card (https://tails.net/support/known_issues/graphics/index.en.html).
2. Reinstall / upgrade Tails version doesn't guarantee it can solve the problem since the problem is hardware incompatibility.
3. If you copy Electrum Appimage to USB, that means you either create persistent storage or manually create additional partition.

If you have just some BTC in your wallet, simple hardware wallet will be ok. You can also look in expert level here - https://sparrowwallet.com/docs/best-practices.html. USB port locking software - https://www.gilisoft.com/product-usb-lock.htm - ~0.0019 BTC/lifetime.

These days Windows let you perform USB whitelist/blacklist. Although it's not as user friendly as software you mentioned.

[tread93]

I would imagine that this is a worthwhile investment for an airgapped device considering that malware can get in though USB ports. Good to know about these blockers

[virasog]

3. If you copy Electrum Appimage to USB, that means you either create persistent storage or manually create additional partition.

You can have non-persistent storage on the tails and still copy the Electrum APP image, open your electrum wallet by importing seeds, perform the offline transaction signings etc and once your done, shutdown the tail. Now next time when you open the tails, you have to repeat the same procedure as you selected non-persistent storage.

If this seems a hassle, (if you often want to sign transactions), you can also make it a persistent storage and protect the tails OS by a strong password. It would still be a safe cold storage because it never touched the internet.

I would imagine that this is a worthwhile investment for an airgapped device considering that malware can get in though USB ports.

You just need a 8GB USB with a free tails OS and your airgapped device is ready almost for free.

[stompix]

More or less to prevent attacks from these kinds of devices: https://shop.hak5.org/products/usb-rubber-ducky
If you come after me with a $5 wrench it's all known and there really is not much that can be done.
If you deploy a payload with one of those devices it could be a lot more difficult to figure out what the hell happened. And how to stop it from happening again.

-Dave

Yeah, my bad, I shouldn't have asked what they're protecting against but more like why do you even need that protection?
It still looks like a "anti tiger rock" to me!

Let's assume you have sensitive data, important data, and your laptop is used to gain access to more sensitive data, why in the name of god would you leave that around with people able to walk by and temper with it? Are you in a cafe, on a trip, just put the damn thing in its case while you walk away, the chances of somebody actually running with it are far higher than some secret agent following you 24/7 and waiting for that moment. Are you concerned about this happening at work while you leave your device alone for a coffee break, for going to another department etc, then your company has a ton more problems than this!!!

But we started this from guys that don't walk with nuclear codes and more with the concern of our Bitcoin funds.
Now,  why would you have your wallets on a laptop you're in a habit of leaving around?
Somebody who would try to follow you around to do that will likely just rob you when you're alone rather than follow you 24/7 and leave his face on 1000 security cameras all over town.

For some guys it might be a solution, but for your average Joe who carries a few mbits in his wallets and wants protection is just overkill.
Besides, it might actually trigger more unwanted attention!

[DaveF]

Was thinking about it a bit and actually came up with one very small possible use for it. To prevent people from doing something stupid.
i.e. you have a PC at your house that others (spouse, kids, whoever) have access to. If the you have no use for USB ports but don't want to shut them down in BIOS but don't want the risk of someone plugging something in then these things would work.

But, over the last couple of weeks this is the ONLY thing I could come up with.

-Dave

[philipma1957]

Was thinking about it a bit and actually came up with one very small possible use for it. To prevent people from doing something stupid.
i.e. you have a PC at your house that others (spouse, kids, whoever) have access to. If the you have no use for USB ports but don't want to shut them down in BIOS but don't want the risk of someone plugging something in then these things would work.

But, over the last couple of weeks this is the ONLY thing I could come up with.

-Dave

Yeah this would work with my wife and prevent errors on her part. It also could delay a quick break in thief as he or she may not want to take the time to figure out what you did and look in your bedroom for cash or jewelry

[LoyceV]

Wouldn't a much better solution be if your computer doesn't do anything without your approval? I know USB is designed to be "Universal" and "plug and play", but it's much safer if your computer doesn't start anything when a connection is made. Manually mount a drive when you need one.

Isn't this a movie thing? Someone plugs in an USB stick, and all data on the screen starts animating towards the stick

I still prefer to stop physical access at a much larger scale, for instance with a lock on a door. Once they've gained access to your computer, you're kinda too late already.

This is the best method, but I prefer to have a port for an SD card or even a USB. Sometimes, there is a need to transfer PSBT files, or there are large signatures for which a QR code cannot be created due to the lack of enough space.

This is the first time I am hearing about this because QR code has not failed me before. What do you mean by large signature?

QR-codes are limited in size:

A QR code is capable of encoding a maximum of 2953 bytes of data, 4296 alphanumeric characters, 7089 numeric characters, or 1817 Kanji characters (character set according to JIS X 0208).

Any half decent BIOS password can't be reset (anymore) by removing the battery.

Keep in mind most of these are going to be on older machines so we are not taking 2023, but 2016....

I thought resetting passwords by removing the CMOS batteries was something from last century.

Was thinking about it a bit and actually came up with one very small possible use for it. To prevent people from doing something stupid.
i.e. you have a PC at your house that others (spouse, kids, whoever) have access to. If the you have no use for USB ports but don't want to shut them down in BIOS but don't want the risk of someone plugging something in then these things would work.

If the separation between users on your OS is so crappy you have to worry about hardware being added, there's a much bigger risk coming from anything they download from the internet.

[Pmalek]

This guy on YouTube says he bought his device with a USB port blocker and was able to remove the blocker using a slightly bent paper clip. He bent the paper clip like a hook and pulled the blocker out. I am not sure how long it took him, but he destroyed the plastic cover at the top of the port blocker while doing it, so I guess it's not as easy as it looks. Still, looks more like protection from your children and not a patient attacker.

https://www.youtube.com/watch?v=zTxgj4Zz8Ig

[LoyceV]

This guy on YouTube says he bought his device with a USB port blocker and was able to remove the blocker using a slightly bent paper clip.

That makes sense, unlike the Kensington opening, USB ports aren't designed to be locked on the inside. This feels like a highly overpriced product anyway, it should be 20 for $2, just like camera covers.

Still, looks more like protection from your children and not a patient attacker.

My kids know my desk is off limits

[stompix]

Besides, it might actually trigger more unwanted attention!

I doubt it. There aren't many people who know about usb port blocker (including me before reading this thread) and there are even less people who can see difference between average usb device and this usb port blocker at a glance.

Yup, you and me!
But we're not spending time at a cafe all day looking for phones and laptops to grab and rush out of it in one second!  I knew a few guys back in the days who although didn't even own a car knew with just a quick look at how each car had its mirrors fixed and how long it took to grab them and the price for it!

To prevent people from doing something stupid.
i.e. you have a PC at your house that others (spouse, kids, whoever) have access to.

No, there is no such thing, or my kid doesn't have the latest firmware! 
The spouse yes, the kid, damn I'm learning every day there is no such thing, and if he can't grab it access it play with it he will just break it! 
We initially had those so-called baby locks on the power sockets that look just like this one, we ended with cover boxes!

This guy on YouTube says he bought his device with a USB port blocker and was able to remove the blocker using a slightly bent paper clip. He bent the paper clip like a hook and pulled the blocker out. I am not sure how long it took him, but he destroyed the plastic cover at the top of the port blocker while doing it, so I guess it's not as easy as it looks. Still, looks more like protection from your children and not a patient attacker.
https://www.youtube.com/watch?v=zTxgj4Zz8Ig

Ok, so I might have got this wrong from the start, thus reaching the wrong conclusion but are those things unique like keys or it's just one universal tool that can unlock 1000 of those Lindy keys?
I had the impression is just a simple usb shaped piece of plastic that has the same locking mechanism and shape for every single one of those. Then it still makes no sense, if somebody is waiting around with a stick full of malware he will have the $20 key also, right?

[NotATether]

Well, when i read these Known issues, the most common one is "Tails not starting at all", this won't be a problem for us because we are not making tails persistence storage. So if somehow your tails USB is unable to load the OS, becomes corrupt etc, you can reinstall tails to the same or a new USB.

Secondly, the Tails OS do not come up with an updated Electurm version but we can download the Electrum Appimage for Linux from https://electrum.org/#download and copy this image through the USB to the Tails. The tails remain airgapped as we never enable the Internet on Tails.

But,
1. If you bother read Tails documentation further, there's also different page dedicated about issue related with graphic card (https://tails.net/support/known_issues/graphics/index.en.html).

Hasn't linux always had issues with graphics cards over the last 2 decades? I don't see how that's going to be a show-stopper from running Tails from LiveDVD. The desktop can easily be ran on the CPU, albeit it'll be much slower. Visual effects will suffer but that's probably not the reason why you are using it.

If you have just some BTC in your wallet, simple hardware wallet will be ok. You can also look in expert level here - https://sparrowwallet.com/docs/best-practices.html. USB port locking software - https://www.gilisoft.com/product-usb-lock.htm - ~0.0019 BTC/lifetime.

These days Windows let you perform USB whitelist/blacklist. Although it's not as user friendly as software you mentioned.

I have never seen this feature. What's the difference from just going to Device Manager and uninstalling the USB port drivers?

[Pmalek]

Ok, so I might have got this wrong from the start, thus reaching the wrong conclusion but are those things unique like keys or it's just one universal tool that can unlock 1000 of those Lindy keys?
I had the impression is just a simple usb shaped piece of plastic that has the same locking mechanism and shape for every single one of those. Then it still makes no sense, if somebody is waiting around with a stick full of malware he will have the $20 key also, right?

I am pretty sure that each key device can remove any port blocker of its type. So, if you have a Type A USB blocker inside one of your ports, you will be able to remove it with any Type A key. I am making that conclusion because you can purchase a pack of like 10 port blockers without the USB key. You wouldn't be able to do anything with them if they had a parent USB key that you don't own.