Hacker News Reader

Comment by nadis | Hacker News Reader

"When I say backdoor, what am I referring to? Sure, Eight Sleep needs a way to push updates, provide service, and offer support. That’s expected.

What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process.

And yes, I found evidence that this is exactly what’s happening."

^ wow, this is pretty wild. <insert joke about being careful about who you share a bed with>

View on HN

You’d be surprised at how many hardware companies think this is a good idea!

I’m the founder and CEO of a company called Memfault, we make observability SaaS for hardware companies.

I constantly get asked if we could just offer a remote access solution. Many of our competitors do! But we think it’s (a) a huge security liability and (b) too ripe for abuse.

But fundamentally consumers do not care, and until that changes you can expect any embedded Linux device to have this kind of backdoor (they do more often than not).

I know it's hard, but keep fighting the good fight. I have huge respect for companies that stand by their principles harder than their revenue.

> What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process.

More companies do this than not.

Sounds like a good way to get bed bugs.

.. I'll see myself out.

I agree with you but please explain how this is any different than when an app on your phone gets updated

It’s completely different.

Could a rogue engineer inject whatever code they want into an app update? Possibly yes, but 1) that code will get shipped to every phone at the same time, 2) that code has to do its thing without anyone noticing, which is tricky at scale (this is how malware gets discovered), and 3) there’s an audit trail so that engineer will be exposed to legal risk.

The difference here is that with Eight Sleep, an engineer can remotely access the customer device in real time and poke around the network the bed is connected to, and there may be no audit logs. They can exfiltrate sensitive data with much less effort and less legal risk than with an app update.

even more so combined with the fact that these are supposedly being sent into the government.

Reply on news.ycombinator.com