It is important to be able to confirm a computer's identity when performing secure transactions. When plugging a USB device into a host, one needs to be sure that the machine is really what is expected, and not a malicious device answering in its place. This paper presents a method of fingerprinting a machine to determine its operating system and model based on the timing of the events in a transaction with a USB device. We chose USB for this task because it is ubiquitous—almost every device has a USB port. Additionally, USB is a master-slave protocol, which ensures that the device gets answers from the host. Unlike performing over a network, where it is difficult to determine which machine is answering, our scheme uses a direct connection to analyze the unique physical characteristics of the host. We show that small and inexpensive commodity devices, which have relatively low granularity in timing measurements, are sufficient for this task.