Hacker News Reader

Comment by warent | Hacker News Reader

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance.

Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're exposing their children to? Then again I've been tech savvy since I was like 11 years old (23 now) so maybe it's just easy for me to say. I just can't comprehend simultaneously having children and not understanding technology.

View on HN

I must have missed the part in the Nest manual where they told you to expect complete strangers to be able to watch you and speak to you through it.

Actually, that is in the manual. That's a feature of the product. You can watch and speak through it. Just because a stranger got your password from an unrelated security breach to Nest, doesn't make it Nest's fault. They have the tools available, and even encourage you in the setup process to setup 2-factor (I just recently set one up). Outside of that, this is user error, in my opinion. Nothing was "hacked" on Nest's end.

It's the part that talks about how there's a camera and a speaker on an IoT device that's connected to the internet.

Seriously, though, my neighbor's entire house is wired up. His lights, his camera / security system, his shades, his music player, his TV... just about everything is integrated into Alexa. It boggles my mind why an otherwise intelligent person would do this.

It's crazy to me that this is the way things are, and that a lot of these companies charge a service fee for remote access. A better way would be VPN offerings for the home from ISPs, and the devices working only locally.

I also missed that in the Facetime manual.

A camera pointing at your face should be assumed to be turned on and recording you.

A camera pointing at your face hooked up to the Internet should be assumed to be broadcasting that information to the world.

We know this intuitively. Humans dislike eye contact from strangers because of what it implies. Cameras don't hit the same basic reflexes (likely because we've optimized them that way).

If we haven't done a good enough job of educating users on that, we need to address it. The UK Government run cybersecurity adverts occasionally. I don't think they go far enough.

I tell everyone I encounter to assume the worst case unless proven otherwise.

The purveyors of a commercial product aren't going to detail these things unless forced. See 'everything else ever' - food, drink, medicine, ...

I wonder if this is a generational thing. I'm gen x and cameras absolutely hit the 'same basic reflexes' for me. When someone has their camera/phone out I sense where it is looking at least as much as I sense where people's eyes are looking.

My millenial girlfriend, my youngest siblings and cousins, etc., don't seem to be aware; nor do they have the same ideas of rudeness/politeness with camera use that I have.

My wife and I are both millennials and all the time she'll be playing with a Snapchat filter holding her phone straight out, and I'll ask her why she's filming me. From the back of the phone, it's completely indistinguishable.

Tech is still in wild-west mode. I can buy food and eat it without testing it for poisons first. I can put my money in a bank without doing my own routine audits of their security. Like nutritional labels on food or a "Schumer box" on a credit card app, maybe we could list some risks and mitigations that the user needs to keep in mind when using the product.

Just because food is poison free doesn't mean it's consequence free. Most people just have a better understanding of food and it's consequences (feeding babies Burger King is a bad idea) when compared to tech and its consequences.

If a company forces two factor authentication, people will go to a product without it, because it's easier. It's easier to blame the product than bad security practices because no one is getting trained on these.

I think the real solution will be for Android and iOS to eventually have 2FA so integrated that any app can use OS APIs to implement it.

Authy is pretty impressive in that regard, I used it for the first time with twilio the other day and was impressed.

Not affiliated with either company.

> I just can't comprehend simultaneously having children and not understanding technology.

Are your parents tech wizards? How about your grandparents?

Generational differences aside, pretty much everyone is clueless about some aspects of technology. You call yourself tech savvy, and I don't doubt you're correct, but I do doubt that your knowledge has no holes. Mine has plenty. And of course the general population's knowledge skews much thinner than HN readers. Many are on the Internet nearly every day of their lives, but ask them about something outside of the few select apps they use, and you're greeted with blank stares. Whether or not they have children is pretty much irrelevant. Giving birth may trigger some instinctive behaviors that come with a certain functional knowledge, but the layers in the OSI model aren't generally included.

Company lied to consumer that this wouldn't happen. Then it happened. And you're blaming the consumer?

Huh? Where do you see anything about Nest telling the consumer this wouldn't happen? They even encourage 2-factor in the setup process of the camera. I've never seen Nest say anywhere that the camera is 100% secure.

Really? Google promised these people that if someone else used their correct username and their correct password, that other person wouldn't be able to log into the Nest camera?

I didn't see anywhere in the article that says Google promised that, and from what I know of security that's impossible. The article did say Google offered a way of increased security, an answer the consumer neglected to use and says isn't enough. (edit - says with absolutely no knowledge on the subject that 2FA isn't enough)

In your opinion, what should Google have done differently here? And where did you see that Google promised no one would be able to log in if that person had the correct username and password and 2FA wasn't enabled?

There was a security breach. The product was operating outside of the behavior range that the parents were told about. If I tell you that my toaster will not catch on fire and then it burns your house down while you use it as instructed, I can't argue that you "didn't understand" its behavior - sure, you didn't predict that it would self-immolate, but is it really your job to reverse-engineer my product to check for poor design?

It is not the toaster company's responsibility to make sure no one gets in your house and puts a fork in your toaster and leaves it running.

Being able to access the camera remotely given the correct password is absolutely within the behaviour range that users are told about. It's the entire point of the product. Do they want remote access or not? If so, then it's the user's responsibility to provision that access appropriately. Passwords and 2-factor might be too complicated for some, but what else do we have?

>We have seen instances where a small number of Nest customers have re-used passwords that were previously exposed through breaches on other websites, and made public. None of these breaches involved Nest. This exposes these customers to other people using the credentials to log into their Nest account.

Subtly, Nest did not actually claim that the attacker had a correct password. For all we know this instance was a breach.

Of course they are not going to give specific details about a particular customer's security incidents in a public statement. And of course they can not publicly claim that they've never had a security breach because it's impossible to know that for sure. I'm not sure how they could make the statement any more specific than they already have.

My understanding is that the password was compromised. It is well within expected behavior for Nest to allow someone with the right credentials to access the connected cameras etc. This isn't a matter of expecting the consumer to reverse-engineer their product and perform a security audit before allowing themselves to trust it, it's a matter of expecting the consumer to understand what credentials are.

Your analogy implies that compromised IoT devices are some rare statistical anomaly that nobody could possibly predict ever happening.

Your reply implies that consumers have a deep understanding of an industry that's outside of their areas of expertise.

Reply on news.ycombinator.com