A guy at the library got up to grab a print job from the machine downstairs. He left his laptop open, logged in, screen glowing, and walked off. He was gone maybe four minutes.
In those four minutes I could have walked over, plugged a small stick into his machine, and walked back to my seat with a frightening amount of his life. He never would have known. The stick looks like a stick.
The tools are a web order away
What I’m describing is a BadUSB: a device that looks like an ordinary flash drive but acts like a keyboard. Plug it in and the computer trusts it instantly, because computers trust keyboards. From there it can type faster than any person and do whatever a logged-in user could do.
This is not rare spy gear. You can buy a Flipper Zero from a legitimate website, with a credit card, and have it shipped to your door. Plenty of cheaper BadUSB-style sticks cost less than lunch, and people build their own for a few dollars and a free afternoon. The barrier isn’t skill or money. It’s whether someone can be bothered.
And what comes off a machine in a few minutes is real: saved passwords, the session tokens that keep you logged in, your files, your messages. “A few minutes” is the generous version. A lot of it happens in seconds.
Why the library
Libraries are one of the last places genuinely open to everyone. That’s what makes them great, and also what makes them a soft target. The same door that lets anyone in lets anyone sit down next to your stuff.
There’s a trust that settles over people there. It’s quiet, everyone’s reading, it feels like a place where nothing bad happens. People who’d never leave their phone face-up on a bar will leave a fully logged-in laptop beside a stranger because the vibes are good. The vibes are not a security model.
Most people won’t touch your things. But security isn’t about most people. It’s about the one, and the library is built to let the one in.
The bigger thing
What actually bothers me isn’t the laptop. It’s that we built a world where a few minutes of lost physical control over one object can cost you your money, your accounts, and your ability to prove you’re you.
Nobody decided this on purpose. We got here one convenience at a time: every “stay signed in” box, every saved card, every account that recovers through the same inbox. Privacy talk usually points at the big faceless threats, the brokers and breaches and governments. Those are real. But a lot of privacy is boring and physical. Whether your screen is locked. Whether the person behind you can watch you type. The gap between the threat model you imagine and the one you actually have, which is some bored person with a USB stick.
Anyway, lock your screen
There’s no clever fix. Windows key + L on Windows, Control + Command + Q on a Mac. Set it to lock itself after a couple of idle minutes so future you is covered when present you forgets. It’s less effort than standing up.
And if you spot an abandoned open laptop, you don’t have to do anything dramatic. A word to the desk is plenty. Your stuff, meanwhile, is fine. This time.