If you've ever tried to do anything advanced on your Android phone, you've likely heard (or read) the term "USB Debugging." This is a commonly-used option that's tucked away neatly under Android's Developer Options menu, but it's still something that many users enable without giving it a second thought--and without knowing what it really does.
For example, if you've ever had to use ADB (the Android Debugging Bridge) to do things like flash a Factory Image on a Nexus device or root a device, then you've already used USB Debugging, whether you realized it or not.
In short, USB Debugging is a way for an Android device to communicate with the Android SDK (Software Developer Kit) over a USB connection. It allows an Android device to receive commands, files, and the like from the PC, and allows the PC to pull crucial information like log files from the Android device. And all you have to do is tick a button to make it happen. Neat, right?
Of course, everything has a downside, and for USB Debugging, it’s security. Basically, leaving USB debugging enabled keeps the device exposed when it’s plugged in over USB. Under most circumstances, this isn’t a problem—if you’re plugging the phone into your personal computer or you have the intention of using the debugging bridge, then it makes sense to leave it enabled all the time. The problem comes into play if you need to plug your phone into an unfamiliar USB port—like a public charging station. In theory, if someone had access to the charging station, they could use USB debugging to effectively steal private information from the device, or push some sort of malware onto it.
The good news is that Google has a built-in safety net here: per-PC authorization for USB Debugging access. When you plug the Android device into a new PC, it will prompt you to approve a USB debugging connection. If you deny access, the connection is never opened. It’s a great failsafe, but users who may not know what it is may just approve the connection all willy-nilly, which is a bad thing.
The other thing to consider is device security should it get lost or stolen. With USB Debugging enabled, any would-be wrong-doer could effectively have access to everything on the device—even if it has a protected lock screen. And if the device is rooted, you might as well give it up: there’s really nothing to stop them at that point. In fact, you should probably make sure you have the Android Device Manager installed on every device you own, that way if it does get lost or stolen you can remotely wipe your data.
Honestly, unless you’re a developer, you probably don’t need to leave USB Debugging enabled all the time. Enable it when you need to use it, then disable it when you’re finished. That’s the safest way to handle it. Sure, it's slightly inconvenient. but it's worth the trade-off.