Windows' Swift Pair pops a friendly 'connect?' bubble for any nearby Bluetooth keyboard, and a $10 chip is enough to be that keyboard

Start with the chip, because it’s ordinary. The ESP32-C5 is, in Espressif’s words, “the industry’s first RISC-V MCU that supports 2.4 and 5 GHz dual-band Wi-Fi 6, along with Bluetooth 5 (LE).” It costs about as much as a sandwich. The MARICHA repo describes itself as a “BLE multi-device emulation and keystroke injection framework for ESP32-C5, with a web UI and serial CLI” — in plain terms, a tiny board that can pretend to be a Bluetooth keyboard.

That’s not exotic. A Bluetooth keyboard is a HID device, and HID is a trusted class by design: once a keyboard is paired, the operating system assumes keystrokes from it are you. There’s no second gate. The keyboard doesn’t prove it’s the keyboard you meant; it just types, and the computer obeys. That’s true of the real keyboard on your desk and of anything the OS has agreed to treat as one.

So the whole security story collapses onto one moment: pairing. On Windows, Microsoft smoothed that moment with Swift Pair. “Introduced in Windows 10, version 1803, Swift Pair is the newest way to pair your Bluetooth peripherals,” Microsoft’s documentation says, and the point is to save you from digging through settings: “Windows can now do this for them by popping a notification when a new peripheral is nearby and ready.” When a device advertises itself, “Windows will show a notification to the user,” and if the device supplies a name, “‘New [Peripheral Name] found’ is shown.” “Selecting ‘Connect’ starts pairing the peripheral.”

Read that as a security prompt and it’s a thin one. A nearby device you didn’t buy can cause a cheerful bubble to appear, wearing whatever name it chose to advertise, and a single click accepts it as an input device. The convenience is real and so is the catch: the notification is the trust decision, and it’s designed to be easy to say yes to.

None of this is a Windows-only flaw or a reason to panic; it’s the normal shape of a trusted device class meeting a convenience feature. Projects like MARICHA are loud demonstrations of a quiet fact, and the maker’s “Mr. Robot” packaging is the showmanship, not the lesson. The lesson is dull and useful: the bubble asking to connect a keyboard deserves the same suspicion as any other “allow?” you didn’t start.