21 ms·

FBI director: Cover up your webcam

332 points by grej 10y ago

meowface 10y ago
I know this thread will probably get politicized, but I see nothing wrong (or necessarily hypocritical; he's law enforcement, not IC) with his advice here.
- waterphone 10y ago
  It's not a bad thing to do, it's just hypocritical of him to value his own privacy but tell everyone else they need to give up theirs and let the FBI and NSA have access to everything they want to keep private.
  - nathancahill 10y ago
    Why would you be concerned about the FBI or the NSA knowing about the content of your digital communiques if you have nothing to hide? Even the most ardent supporter of personal freedoms will admit that the government observing you over a network is the same as taking pictures of you with a telephoto lens on a busy street. The truth is the same: there are too many people and you aren't special enough to deserve personal surveillance.
    - fl0wenol 10y ago
      This is a very weak analogy. What the NSA is doing right now, and what the FBI would like access to, is in no way similar to taking pictures of you on a busy street. What the NSA has is every intersection wired up with cameras, recording 24 hours a day, and all of it indexed with facial recognition and license plate readers. No organization should have that much information or reach at their fingertips, no matter how virtuous the mission or the people working there.
    - flukus 10y ago
      > Even the most ardent supporter of personal freedoms will admit that the government observing you over a network is the same as taking pictures of you with a telephoto lens on a busy street. Is it? If i'm having a 1 to 1 conversation with someone online then that is a private conversation. There monitoring my traffic is more like opening the letters I would be sending that person. More fundamentally though, the meat space public/private divide does not map at all to the cyber space one, all analogies and laws to apply one to the other are flawed.
    - deleted 10y ago
      [deleted]
    - iamdave 10y ago
      Are we really still building a brick wall between "nothing to hide" and "prefer to keep personal"? I'm asking this as far away from the legal and moral realms as possible; do people just not even deserve the basic benefit of having aspects of their day-to-day kept to themselves, even if it might not be inherently and/or objectively wrong? Because that's the question I hear being begged when the "you have nothing to hide" counterpoint is brought up. You've got nothing to hide, so let me just look anyway. Sure it's none of my business, and I have no actionable legal right to it, but it's not illegal so why don't you want me to see it?
    - anexprogrammer 10y ago
      > there are too many people Oh please. They can probably harvest the lot. It'll be some algorithm that deems you worthy or otherwise or gets you on an "of interest" list. Let's keep "personal surveillance" for '50s spy movies and Banksy murals. More generally, what about the chilling effect on legal and legitimate conversation?
      - jeremysmyth 10y ago
        It'll be some algorithm that deems you worthy or otherwise or gets you on an "of interest" list. ...or your association with "Occupy" or some other political protest movement that someone in power disagrees with, or that your wife bullied some politician's wife for two weeks in school, or that your interfering neighbour with a petty dislike of how you landscape your garden works as a government clerk and can access your data. There are many reasons why some individual might want to know private things about some other individual. When individuals with some tiny (or vast) power want to wield it over anyone else, especially when they can do it with little oversight, it's very tempting. That "the government" has access to my private information does not mean it's blind and faceless. It's made up of people with complex motivations.
    - ubernostrum 10y ago
      You're probably trolling, but... The reason why we don't give broad general search powers to the government (or at least, in theory don't give the government broad general search powers) is because the government can prosecute people, and given enough information they can find a reason to prosecute anyone. Which then fully opens the floodgates to selective prosecution: anyone who's disliked by someone in power will simply be prosecuted and likely convicted and jailed, because everyone will have done something that an all-seeing government can prosecute for. Cardinal Richelieu is alleged to have said that, given seven lines written by the most honest of men, he could find something in them to create a capital offense and have the man hanged. I'd rather not live in a society where anyone has that kind of power.
  - takeda 10y ago
    Similarly Hilary advocates for banning encryption yet makes her staffers using Signal application to encrypt their correspondence. Our government is full of hypocrites.
    - sigmar 10y ago
      >Similarly Hilary advocates for banning encryption Does she? Her tech platform seemed pretty supportive of Apple's stance on encryption: http://appleinsider.com/articles/16/06/29/hillary-clintons-tech-platform-backs-apple-inc-positions-on-encryption-privacy-innovation http://appleinsider.com/articles/16/06/29/hillary-clintons-t...
      - takeda 10y ago
        It's really hard to say what she supports. She changes her opinion so often trying to appease everyone, but is clear that she wants government to be able to decrypt communication: https://www.techdirt.com/articles/20151220/08101633141/hillary-clinton-wants-manhattan-project-encryption-not-back-door-that-makes-no-sense.shtml https://www.techdirt.com/articles/20151220/08101633141/hilla...
    - meowface 10y ago
      That's much worse and far more hypocritical than Comey's remark.
  - abraae 10y ago
    Perhaps he's not concerned about the FBI and NSA viewing him in the buff (seems to be a recurring theme here - am I the only person who uses his computer fully clothed?) but rather the Russians/Chinese/enemy.
  - WillPostForFood 10y ago
    He might be wrong (about wanting to able to snoop), but it isn't hypocritical. He is saying protect yourself from illegal hacking by bad actors, but submit to legal snooping by the government. Again, he might be wrong about wanting various legal means to snoop on people, but not hypocritical.
  - derefr 10y ago
    Typical mind fallacy here, I think. I don't imagine the directory of the FBI gives one whit about "privacy." Instead, picture them spending all day thinking about "national security." Citizens have to tell the government everything—because doing so enhances national security. The government must not reveal anything to its citizens—because doing so would compromise national security. Pretty straightforward.
- AndrewKemendo 10y ago
  The FBI is part of the intelligence community. [1] https://www.cia.gov/about-cia/eo12333.html#1.7 https://www.cia.gov/about-cia/eo12333.html#1.7
dingo_bat 10y ago
I have never covered my Webcam because I trust the light to come on if the camera turns on. Is it possible to bypass that led?
- mpetrovich 10y ago
  Absolutely: https://www.grahamcluley.com/2013/12/webcam-spying-without-turning-led-researchers-prove-possible/ https://www.grahamcluley.com/2013/12/webcam-spying-without-t...
- aboonaboo 10y ago
  Absolutely
- aboonaboo 10y ago
  Absolutely short of the led being physically wired to turn on when the camera circuit gets power or something
- statenjason 10y ago
  If the light goes on, then it's too late.
- 1123581321 10y ago
  Unless the camera and light are on the same circuit, it is possible to bypass the light via some software change.
- tqkxzugoaupvwqr 10y ago
  From a user perspective it is hard to know whether the webcam LED is software controlled. If it is software controlled, e.g. by the webcam driver, it is prone to manipulation and could remain off while the webcam is recording. Of course, there are many cameras that do not even have an activity indiator (LED), e.g. stand-alone cameras, or simply your phone front and back camera. I find it a good habit to cover all cameras, regardless of wether they have an indicator.
- Steuard 10y ago
  In addition to the attacks that others have mentioned here, I've also heard folks comment previously on the possibility of turning on the camera very briefly, just long enough for a single still shot. If it was done fast enough, the brief flicker of the LED might not be noticeable. (Like you, I had always assumed that the power for the webcam was literally in series with the LED, so that disabling the LED would render the camera inoperable. That seemed like the obvious way to do it if you wanted to provide a truly reliable signal. But evidently that's not the case.)
deleted 10y ago
[deleted]
6t6t6t6 10y ago
From all they ways I can be spied, the webcam is the one that concerns me the least. At the end, all they will see is a bearded man staring to the front. May they be able to see me naked? Well, probably, but I honestly don't think that they will make a lot of money by selling my naked pictures... My wife tells me that I still look good, but I suspect that she is being nice to me. What would scare more is that they manage to capture what is on my screen, or install a keylogger, or activate the microphones to hear my conversations, or that they access my hard disks and steal data, including my private keys. Hey, but putting a sticker on your webcam is a way to show how 1337 your are! I prefer not to have to bother removing stickers every time I want to do a Skype call.
- rpgmaker 10y ago
  On amazon there are cam blockers with a lid that allows you to block and unblock the cam.
- eganist 10y ago
  In fairness, you can still capture conversations from a webcam if your mark is speaking right in front of it, regardless of whether microphones are on.
  - stephentmcm 10y ago
    Source? I'd hazard a guess that it's likely only marginally more accurate than lip reading?
    - bradbeattie 10y ago
      http://people.csail.mit.edu/mrub/VisualMic/ http://people.csail.mit.edu/mrub/VisualMic/
      - sillysaurus3 10y ago
        Interesting technique. This requires 60fps 1280x720 video. People would surely notice the slowdown. I wonder if it's possible to improve on this?
ipsin 10y ago
If you're so concerned about having your webcam subverted, it seems like the first step would be to insist on a hardware LED that can't be subverted in firmware. If nothing else, it would serve as a canary, indicating that your machine has been thoroughly compromised.
- gkoberger 10y ago
  And who do we trust to do that? More importantly, is it even possible?
  - krastanov 10y ago
    In terms of electronics it is fairly trivial and it can be inspected by eye (or microscope) if the manufacturer decides to not encapsulate everything on a chip (which presumably would be the point of such a feature). Just have the only positive voltage rail going to the camera be the same one that is directly powering the LED. The firmware will be turning this rail on and off, hence turning the camera and the LED on and off simultaneously.
    - 1_2__3 10y ago
      Idle though on possible attack vectors: Convince the firmware to use a lower voltage, one that doesn't hit the breakover voltage on the LED but still powers the camera. Strobe the line, get snapshots without the LED doing more than very faintly glowing.
      - krastanov 10y ago
        I have a very hard time believing that the camera itself will not brownout in such a case.
      - umanwizard 10y ago
        LED activation voltage is less than what cameras typically require.
deleted 10y ago
[deleted]
mpetrovich 10y ago
But what about his computer's built-in mic? Unless he's pantomiming all sensitive info...
andrewflnr 10y ago
So the guy who decries "going dark" when it comes to encryption wants us to literally go dark with our webcams. It's like a dystopian comedy setup.
rdtsc 10y ago
This is like the coal burning power plant telling you to make sure to sort your recyclables into appropriate containers, to make the environment cleaner. Also people enjoy and feel good about accomplishing small things. Putting a sticker on your laptop is a small easy task. Do it and they feel more "secure" in an instant.
Hilyin 10y ago
I guess this is just as good place as any to bring this up. In current OS X, you cannot disable your mic. You can turn down the input volume, but never disable. All malware needs to do is raise the input volume and it can listen to you to its hearts content. And its worse with your iPhone.
- the_common_man 10y ago
  Can someone confirm if this is actually true? Sounds too far fetched that you cannot disable the mic (i.e not muting, I assume?).
  - Hilyin 10y ago
    Just look around on the internet, you'll find the same thing. I researched this a few weeks ago and was amazed. You basically have to disable the audio driver in OSX to disable it, and doing that, means you can't play audio at all. And even that isn't enough, it technically can be hijacked at an even lower level.
sotojuan 10y ago
The webcam cover up is interesting to me because it's the only "weird privacy thing" I've seen regular, non-technical people do. A good amount of people at my university, most of which use social media liberally and don't care about encryption, cover their camera up.
- smelendez 10y ago
  It actually seems less weird to me in a university setting. Most university students live in small quarters, so they're more likely to have a computer in front of them while they're nude, using drugs, having private conversations or doing other private things. They're also around lots of new people of varying levels of maturity who could have a decent chance of getting physical or network access to their computer, much more than neighbors in the rest of the world. A creepy stalker or blackmailer spying on a university student through a webcam sadly doesn't seem that farfetched, especially for women.
- wingerlang 10y ago
  I think university aged women would be the most logical person to cover up their camera.
- JohnStrange 10y ago
  It's not weird at all. Women should definitely always do that, because they use their laptop everywhere, e.g. in bed, and there are plenty of viruses and trojans that activate the webcam for sextortion and stalking purposes.
- pseudonymcoward 10y ago
  This is only idle speculation but: A web cam resembles an eye staring at you all the time. This makes people feel weird, like something is staring at them. The threat to privacy is right in their face and on a gut level. That's the reason so many people cover them even when they won't take other basic online privacy precautions.
  - Sylos 10y ago
    Also just in general, people understand what a camera does. It's much harder to understand the implications of abstract "data" going off onto the internet.
boxkite 10y ago
I keep mine covered because I work remotely a lot and I don't want to accidentally shirtless video chat someone from bed when I meant to make a different type of call.
- 3chelon 10y ago
  It was unusually hot and I actually did that myself just the other day - embarrassing!
deleted 10y ago
[deleted]
whitenoice 10y ago
Just saw the prescreening of snowden movie with online live event with movie cast and snowden post movie, and this was exactly what was depicted in the movie and in the event talk.
skybrian 10y ago
Back in the day, SGI workstations had a hardware shutter. I still think it's a good idea.
white-flame 10y ago
I said it then, and I say it now: - Encryption is our webcam tape. That tape cannot be thwarted by any remote attacker, legally warranted or not. It's perfect, unbreakable security from webcam visuals being exfiltrated, exactly the security features that Comey says we shouldn't be allowed to have for our data.
- pdkl95 10y ago
  "What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity." ~ Philip Zimmermann, "Why I wrote PGP" https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html
  - drvdevd 10y ago
    A brilliant point and a salient quote. Why must we continue to live, collectively, with our heads in the sand?
- alanwatts 10y ago
  It's not perfect if your endpoints are compromised.
stanislavb 10y ago
Hypocrite!
conradev 10y ago
I use a MacBook Pro as my daily driver, but I recently purchased a Lenovo ThinkPad to play around with. Sometimes I forget how awesome it is to have a repairable and modular computer. I didn't want the webcam or microphone in the ThinkPad… so I took 30 minutes and removed it. Easy as that.
- csydas 10y ago
  Well,to be fair you could just open the MacBook Pro and unplug the ribbon for the webcam. iFixit will have instructions. Removing it entirely granted is another matter, involving opening the screen, but you'd have to do the same on any modern laptop with an integrated camera wouldn't you?
  - wruza 10y ago
    For my mac I just used a knife to open screen and shoved black paper strip before camera.
meltbuzz 10y ago
nice
neom 10y ago
It's pretty sad that he used the word "authority" in this sentence: You do that so that people who don’t have authority don’t look at you. I think that’s a good thing.”
mmaunder 10y ago
I wonder if he covers front and back cellphone cameras.
orthogon 10y ago
What about the part where we stop buying products with integrated cameras? What about the part where we stop buying devices that we have seeemingly no hope of control over? What about that? Is boycott a word too strong? Gee, you're right. We should all just give up, and accept that what we're sold, is that which we must buy.
- deathanatos 10y ago
  I think you're being a bit quick to judge people here… Having an integrated camera is obviously a lot easier to deal with, logistically, than lugging along an external USB camera. I think a lot of the people here would love to have hardware-level kill switches for their video camera. And mic. And WiFi. (I would; I used to own a Thinkpad with a hardware kill switch for WiFi. It was useful, even aside from the privacy benefits.)
  - orthogon 10y ago
    I think you're neglecting a key detail: alternatives are hardly even on the shelves, and NO ONE QUESTIONS IT. > Oh, well, that's just supply and demand, of course! > Everyone just WANTS an always on internet connection! > Why would anyone ever remove the battery from their cell phone??? > It's more cost effective to build the device like that. Common sense! > Everyone wants a unique identifier, GPS and 911 service. It's safer! Yup, no one would ever want things any other way. It's silly to question why the invisible hand of the market works as it does.
    - derogator 10y ago
      The really amazing part about the downvotes here, is that HN is unable to reconcile the realities of mass surveillance that tend to conflict with profit motives, and yet the collective overtone of HN professes itself to be a bastion of progressive futurist space exploring tranhumanism. Few seem to notice the cognitive dissonance. Sort of a cruel prank. Those in the best position to release the yoke, are only motivated to tighten it.
  - 10y ago
foobarcrunch 10y ago
Unless you're using Prey[0] and want an opportunity to photograph would-be crooks. [0] https://preyproject.com https://preyproject.com
greglindahl 10y ago
I experimented a bit with an Apple laptop microphone, and it took 2 layers of electrical tape to block the mic. There doesn't appear to be any way to block an iPhone mic without blocking the speaker, too, and I'm not confident that it could be blocked at all.
markyc 10y ago
in this day and age how come we don't see laptops carry a physical on/off switch for the microphone and camera?
- exmuslim 10y ago
  My laptop is long pass the warranty so I did it myself.
- Shanea93 10y ago
  This is the day and age of removing headphone jacks to make a phone slimmer, taking away your disk drive, etc. Most companies care more about aesthetics than functionality at this point.
  - ojii 10y ago
    can I have a laptop without a webcam/integrated mic then?
    - soylentcola 10y ago
      How courageous of you!
- dndln 10y ago
  Purism has a laptop with 2 physical switches, and it runs linux too. https://puri.sm/librem-13 https://puri.sm/librem-13
- pwg 10y ago
  Some older laptops did have physical on/off switches for the wifi card (this was prior to the advent of a camera in every laptop). The old Dell D820 was one such laptop. That was likely not the only one. Gradually they were dropped from newer models because the manufacturers saw no sales changes due to the presence/absence of the switches (i.e., not enough purchasers refused to buy the "new" laptop because it dropped the physical on/off switch, which is the only feedback the makers truly understand and pay attention towards). And dropping the physical switch saved the manufacturer a small amount on each laptop, which when multiplied across the numbers built was either a nice profit increase or a small price reduction (or likely a little of both).
benevol 10y ago
Every electronic communication device (laptop, mobile, tablet, etc) should have 1 hardware switch per sensor (camera, mic, motion/acceleration, etc) which disables the sensor. Why manufacturers still haven't introduced this is beyond me.
- dndln 10y ago
  Here's a linux-running laptop that has 2 hardware switches: https://puri.sm/librem-13 https://puri.sm/librem-13
  - bo1024 10y ago
    Wow, interesting, I didn't know about this.
- pwg 10y ago
  >Why manufacturers still haven't introduced this is beyond me. Expense and lack of demand. Some older laptops used to feature hardware kill switches for the wifi (this was prior to the advent of a camera in every laptop). The old Dell D820 model was one such laptop. Eventually they were dropped all around because from the makers point of view, the presence of the switch had no effect on the sales of the laptops. Anything you add to the BOM (Bill of Materials) for the device raises the final net cost, and there is still enough competition in the laptop/phone space that keeping the costs down is necessary to compete. Additionally, twenty-five cents per unit does not sound like much, until of course you multiply that by 10+ million units built (where a twenty-five cents difference per unit amounts to $2.5+ million difference in the end). So if having the switch or not having the switch made no difference in sales, the maker could either raise their profit, or lower their price (or more likely split the difference) by dropping the switches. The lack of demand is that not enough purchasers are telling manufacturers they want hardware on/off switches (the purchasers do this by buying only laptops with them, and by not buying laptops without them [which may be difficult to bootstrap now, given that almost no laptop has a hardware on/off switch anymore]).
  - jcadam 10y ago
_Codemonkeyism 10y ago
"The head of the FBI on Wednesday defended putting a piece of tape over his personal laptop's webcam, claiming the security step was a common sense one that most should take." One needs to ask why is the head of the FBI telling you this? Cui bono? This is a red herring. The FBI has no interest in filming you through your webcam. They want to listen to your microphone, watch your screen, get the keys you've typed, see the websites you've visited, read the emails you've sent. Watch you on video? Nah. This is a red herring. That is the reason the head of the FBI tells you to cover your webcam. I wish the The Last Psychiatrist would come back.
- tingol 10y ago
  The FBI isn't telling you this so you could protect yourself from the government. They are telling you this because they know how easy it is for someone else to take control of the camera and make your life hard. So it is a common sense step for you to take if you're concerbed about security. You took a pretty huge jump from that to the FBI listening to your mic.
- anjc 10y ago
  I guess it's also in the interests of the US authorities that their country isn't subverted via normal citizens through blackmail.
- severine 10y ago
  It saves them bandwidth, too, doesn't it?
- rurban 10y ago
  Taking screenshots at exactly the same time when the observant is typing something into the very same laptop makes for undeniable evidence to the judge.
- mattnewton 10y ago
  I do think the FBI has a track record of infringing privacy and bending the law, but the FBI isn't always the boogeyman. Here they are probably actually trying to do their job, which includes protecting citizens from blackmailers and other baddies.
janvidar 10y ago
Isn't this really just a sign of flawed hardware design? In my opinion hardware should be designed so that the camera LED lamp should always be lit if the camera is used. If there is a malfunction with the LED, then the camera should also not work. Also there should be a hardware LED for when the microphone is being used which should work in the same fashion for laptops with built-in microphones. In the webcam drivers I have looked at the LED is controlled independently of capturing, although drivers do enable the LED when the camera is used. This essentially means that hackers can record and disable the lamp. I've been considering hacking together some piece of software that will continuously use the camera (/dev/video) in order to block it for other applications, and have it fail with visible alerts if unable to block the camera. Not sure if the same thing can be achieved for the audio recording devices due to multiplexing.
- onion2k 10y ago
  In my opinion hardware should be designed so that the camera LED lamp should always be lit if the camera is used. That would only inform the user that the camera is on, and that isn't good enough. If the user is paying active attention to the computer then they can take action, but if they're not then they can't - noticing an LED has switched on when you're busy doing something else in the same room is quite unlikely. Even if you're actively using the computer you could miss it if you're focused on a task. A hardware switch that disables the camera or a lens cover that blocks it entirely (eg tape) are the only safe options.
  - Houshalter 10y ago
    The hardware switch won't tell you that your computer has been hacked. The camera light will. And a lens cover won't protect your microphone or your personal data.
    - dndln 10y ago
      If you are hacked, the camera light won't tell you. The camera light also won't protect your microphone or your personal data.
eosrei 10y ago
What about the cameras in your phone and the microphones in everything? Security theater isn't security.
xcasperx 10y ago
I agree with what most people are saying on here, but I believe there's a bigger picture to it. Let's say that your computer has been completely 'pwned', and that you are currently reading an article with an ad for Cow Porn, or whatever, on the right hand hand side of the site. The hacker can write some code to check what your eyes, and eyebrows, did when you looked at the ad. If it peaked your interest, the hacker can maliciously add more 'Cow Porn' ads to sites you visit - via swapping out the regular ones. Now one day you get curious and click on it, and boom they take a screen shot and try to blackmail you. This is obviously quite outlandish but think about purposefully planting posts, lets say on reddit, by switching out posts. They then look at your head movements, and, or, eye movements then boom, you're added to some list that you wouldn't have be added to if it weren't for your eye movements.
bobsoap 10y ago
Instead of a sticker, one could also use this clever, simple, magnetic gadget (not affiliated): https://www.kickstarter.com/projects/1893116150/nope-20-live-free https://www.kickstarter.com/projects/1893116150/nope-20-live...
- bobsoap 10y ago
  Seriously, downvoted without an explanation? That's quite poor. If something about my post offends anyone, I'd love to know about it.
listentojohan 10y ago
What I don't understand is why he has to defend it? (Yes, it might seem hypocritical.)
demonshreder 10y ago
Aren't these attacks primarily for Windows? Would using Linux (say Arch) mitigate these? Edit: Shouldn't we be more concerned about phones and tabs?
- facepalm 10y ago
  Nice attempt at humor :-)
SG- 10y ago
Anyone know what kind of laptop he uses?
codethief 10y ago
In case anyone's looking for something a little bit more sophisticated than a sticker to put on his/her webcam: https://soomz.io/detail/webcam_covers_a10 https://soomz.io/detail/webcam_covers_a10 Been using it for a while and it works like a charm. (Though on a phone it does tend to attract a bit of dirt and the color wears off over time. If you keep your phone in the pocket of your pants, that is.)
caub 10y ago
Laptops have a LED showing when webcam is in use
laurent123456 10y ago
This article describes how to turn off the led light on Windows, which is surprisingly easy: http://blog.erratasec.com/2013/12/how-to-disable-webcam-light-on-windows.html http://blog.erratasec.com/2013/12/how-to-disable-webcam-ligh... TLDR: Webcams follow the UVC standard and, according to this standard, the LED indicator light is controlled by the host software. So a simple hack is to find the webcam driver DLL, find the function that controls the LED (such as TurnOnOffLED()), make it return immediately, done.
pjc50 10y ago
Previously: http://www.independent.co.uk/life-style/gadgets-and-tech/yahoo-webcam-users-intimate-images-intercepted-by-gchq-spy-programme-snowden-files-reveal-9158140.html http://www.independent.co.uk/life-style/gadgets-and-tech/yah...
chrischen 10y ago
Quick question for HNers: why isn't something like the camera insicator light implemented for the microphone?
throw2016 10y ago
The hacker news readership is focussed on startups and technology. It's a career, a business and in some cases an interest in technology. So privacy as a social good may not be the primary perspective and it often devolves into how this affects readers personally rather than the society they live in or side tracks into technology nuances. Technology is enabling new negative possibilities but it does not follow that technologists can make a difference. There is no ethical code of conduct. Like everyone else they are another cog in the wheel and software engineers may not have an interest or priority on privacy, social and political issues. There are a large number of folks working in the nsa, gchq, google, facebook, palantir, hardware vendors and elsewhere actively enabling this. Like technology itself politics, liberty, privacy and the evolution of modern system from the time of feudalism requires interest and priority. From this perspective the need to tape up your webcam may have completely different ramnifications.
zelos 10y ago
Didn't all Sun webcams used to have little irises that you could close on them? It seems like a sensible precaution: makes it less likely I'll accidentally log into a company conference call in my dressing gown with my camera enabled.
wickedlogic 10y ago
Please cover your webcam, it is distracting while we are trying to listen to what you are clicking on.
awesomerobot 10y ago
Also remove your microphone and don't use a keyboard? If I were hacking you I'd _much_ rather log your keystrokes or hear what you're saying. The number of scenarios where having a visual would be useful would be incredibly low by comparison. Putting a sticker over your webcam is like putting a lock on a screen door.
- maxerickson 10y ago
  Most screen doors I can think of do have locks. Even quite home made ones often end up with a hook that kids can't reach.
  - awesomerobot 10y ago
    That's my point. It does one thing, but it's by no means security.
24gttghh 10y ago
My Asus 1015PEM netbook from 6 years ago has a physical screen that slides over the camera; sliding the screen also turns on the camera. Why don't more laptops have this feature if this is such a 'big deal'?
piedradura 10y ago
I prefer to have a computer composed by parts, so I attach the webcam to the computer when I need to, same thing for the audio and many other applications. I only need 1k of ram to send a secret message, so no virus or malware could be in my tiny computer.
tedmiston 10y ago
Does anyone feel the need to cover their iPhone front facing camera?
- e1ven 10y ago
  Yes. I cover both the cameras on my phone with tape, and only remove it when I want to take a picture. That said, I have a lot more faith in the security of a whitelist-based model like the App store, versus the blacklist model of a PC with antivirus.
mangeletti 10y ago
I swear this is a true story: I worked at Staples when I was 19, and when I first started I was a "front end lead" (read: the only full-time cashier), so I would work behind the service counter at the front. Once, I was standing up front while there were no customers when all of the sudden the voice of the general manager (we'll call him Bill) popped onto the phone's speaker, "Hey, Michael". I looked up and noticed the light next to "Manager's Office" was on. I instinctively replied, "Hey, Bill; what's up?", despite the fact that it nearly gave me a heart attack. Bill proceeded to tell me to run something he needed to the back, which I did, and that was the end of that. Then, one day I was helping a customer with some Cross pens behind the counter. I stood up to grab a key that was next to the register when I noticed out of the corner of my eye that the phone's "Manager's Office" intercom light was on. It made my heart jump because I hadn't talk to anybody through it, and I knew that Bill was in the back office. I immediately realized, 'oh my god, he's probably spying on me to see how my service is!'. It made me feel uncomfortable, until I realized it was an opportunity to be extraordinarily helpful and jovial with the customer and be "candidly" observed by my manager. So I did that. I rang the customer up and she left. The light went off after a few minutes of silence. After that, I noticed the light come on a number of times on different days, which surprised me. I even ran to the back after helping a customer once, while the intercom light was still on, sneaked around the corner, and looked into his office window to see if it was really him. He was sitting there looking at his phone. I looked for just a moment when I heard from the speaker above, "<beep!> cashier to the front". I ran. Bill was probably the greatest manager I've ever known, such a hard worker, a really cool guy to talk to, well respected by everyone, etc. In fact, if all managers were like him, Staples would probably still be a force to be reckoned with. So, it never bothered me the way it probably would have, had it been some creepy manager. This is necessary for the rest of the story, because had it not been the case, I would have probably called him out, etc. Eventually I started being extra jovial all the time, because I never knew when I'd miss seeing the light come on and miss the opportunity to impress Bill. Bill was so impressed with my service that I was given a raise and promoted to manager of the copy & print center about 6 months later, which eventually led to me opening my own print company and quitting Staples (after seeing how high the margins were), which led to me learning how to use Adobe Creative Suite and graphic design, which led to me shifting my focus to print design for clients (brochures, cards, etc.), which led to me meeting some guys who ran an Internet marketing company one day while trying to sell my print design services. They wanted to hire me full time, and did, so I began learning web design, then web development, then back end code, etc. I always tell myself, 'I was probably destined for this kind of work', but the reality is that my entire life might have been changed by simply knowing I was being spied on by my Boss. I realize that it probably worked out for the better in my case, but the fact is, knowing that somebody is watching you causes you to change who you are. It's a form of control in and of itself. In fact, it doesn't even need to happen to you. Now that we have all seen that the government does spy on people, it's hard to imagine all the tiny ways that it might change your behavior and the things you say (e.g., online).
lovedj 10y ago
I'm more scared of them capturing what's ON the screen.
ssebastianj 10y ago
I was looking for a way to cover the mics and webcam integrated in my laptop which doesn't require a tape. So, I grabbed a couple of those magnets stripes usually found on fridges and then , using a scissor, made two little rectangular stripes and a larger one. Next, I glued the little stripes on the laptop, near close the mics. The nice thing is that the large stripe covers both, the mics and webcam. For me, it's an easy way to cover/uncover fast.
JustUhThought 10y ago
At some of my house parties I require guests to check their phone at the door. Price of admission. (I keep a landline and am ok with giving that number out as an emergency contact number). Boy does this get the conversation started. I can tape my phn camera, but what about the other 20 phns in the room? I have no control over them to keep them from posting photos of me drinking or whatnot during a party, photos I do not want online. From the tin-hat perspective one must do (much) better than consider their personal devices. One must consider all devices in their personal proximity .
- GarrisonPrime 10y ago
  It'd be amusing to have a little Faraday cage by the door for them to deposit into. :)
throwaway13337 10y ago
It's relatively common to have access to private security cameras. Some are even google indexed. The software included relies on the users protect the web interface. Obviously, this is the vulnerability. Especially with things like default passwords. Here's an article about it: http://www.networkworld.com/article/2844283/microsoft-subnet/peeping-into-73-000-unsecured-security-cameras-thanks-to-default-passwords.html http://www.networkworld.com/article/2844283/microsoft-subnet... A lot of these cameras are controllable and have speakers. People now do live video streams of pranking people through this means. Pictures: http://imgur.com/a/0WImd http://imgur.com/a/0WImd
krinchan 10y ago
I'm about to die laughing at the hoops people are jumping through in the comments to claim they've never pulled up some porn and enjoyed themselves in front of their laptop. Ever. EVER

332 points by grej 10y ago

I know this thread will probably get politicized, but I see nothing wrong (or necessarily hypocritical; he's law enforcement, not IC) with his advice here.

waterphone 10y ago
It's not a bad thing to do, it's just hypocritical of him to value his own privacy but tell everyone else they need to give up theirs and let the FBI and NSA have access to everything they want to keep private.
- nathancahill 10y ago
  Why would you be concerned about the FBI or the NSA knowing about the content of your digital communiques if you have nothing to hide? Even the most ardent supporter of personal freedoms will admit that the government observing you over a network is the same as taking pictures of you with a telephoto lens on a busy street. The truth is the same: there are too many people and you aren't special enough to deserve personal surveillance.
  - fl0wenol 10y ago
    This is a very weak analogy. What the NSA is doing right now, and what the FBI would like access to, is in no way similar to taking pictures of you on a busy street. What the NSA has is every intersection wired up with cameras, recording 24 hours a day, and all of it indexed with facial recognition and license plate readers. No organization should have that much information or reach at their fingertips, no matter how virtuous the mission or the people working there.
  - flukus 10y ago
    > Even the most ardent supporter of personal freedoms will admit that the government observing you over a network is the same as taking pictures of you with a telephoto lens on a busy street. Is it? If i'm having a 1 to 1 conversation with someone online then that is a private conversation. There monitoring my traffic is more like opening the letters I would be sending that person. More fundamentally though, the meat space public/private divide does not map at all to the cyber space one, all analogies and laws to apply one to the other are flawed.
  - deleted 10y ago
    [deleted]
  - iamdave 10y ago
    Are we really still building a brick wall between "nothing to hide" and "prefer to keep personal"? I'm asking this as far away from the legal and moral realms as possible; do people just not even deserve the basic benefit of having aspects of their day-to-day kept to themselves, even if it might not be inherently and/or objectively wrong? Because that's the question I hear being begged when the "you have nothing to hide" counterpoint is brought up. You've got nothing to hide, so let me just look anyway. Sure it's none of my business, and I have no actionable legal right to it, but it's not illegal so why don't you want me to see it?
  - anexprogrammer 10y ago
    > there are too many people Oh please. They can probably harvest the lot. It'll be some algorithm that deems you worthy or otherwise or gets you on an "of interest" list. Let's keep "personal surveillance" for '50s spy movies and Banksy murals. More generally, what about the chilling effect on legal and legitimate conversation?
    - jeremysmyth 10y ago
      It'll be some algorithm that deems you worthy or otherwise or gets you on an "of interest" list. ...or your association with "Occupy" or some other political protest movement that someone in power disagrees with, or that your wife bullied some politician's wife for two weeks in school, or that your interfering neighbour with a petty dislike of how you landscape your garden works as a government clerk and can access your data. There are many reasons why some individual might want to know private things about some other individual. When individuals with some tiny (or vast) power want to wield it over anyone else, especially when they can do it with little oversight, it's very tempting. That "the government" has access to my private information does not mean it's blind and faceless. It's made up of people with complex motivations.
  - ubernostrum 10y ago
    You're probably trolling, but... The reason why we don't give broad general search powers to the government (or at least, in theory don't give the government broad general search powers) is because the government can prosecute people, and given enough information they can find a reason to prosecute anyone. Which then fully opens the floodgates to selective prosecution: anyone who's disliked by someone in power will simply be prosecuted and likely convicted and jailed, because everyone will have done something that an all-seeing government can prosecute for. Cardinal Richelieu is alleged to have said that, given seven lines written by the most honest of men, he could find something in them to create a capital offense and have the man hanged. I'd rather not live in a society where anyone has that kind of power.
- takeda 10y ago
  Similarly Hilary advocates for banning encryption yet makes her staffers using Signal application to encrypt their correspondence. Our government is full of hypocrites.
  - sigmar 10y ago
    >Similarly Hilary advocates for banning encryption Does she? Her tech platform seemed pretty supportive of Apple's stance on encryption: http://appleinsider.com/articles/16/06/29/hillary-clintons-tech-platform-backs-apple-inc-positions-on-encryption-privacy-innovation http://appleinsider.com/articles/16/06/29/hillary-clintons-t...
    - takeda 10y ago
      It's really hard to say what she supports. She changes her opinion so often trying to appease everyone, but is clear that she wants government to be able to decrypt communication: https://www.techdirt.com/articles/20151220/08101633141/hillary-clinton-wants-manhattan-project-encryption-not-back-door-that-makes-no-sense.shtml https://www.techdirt.com/articles/20151220/08101633141/hilla...
  - meowface 10y ago
    That's much worse and far more hypocritical than Comey's remark.
- abraae 10y ago
  Perhaps he's not concerned about the FBI and NSA viewing him in the buff (seems to be a recurring theme here - am I the only person who uses his computer fully clothed?) but rather the Russians/Chinese/enemy.
- WillPostForFood 10y ago
  He might be wrong (about wanting to able to snoop), but it isn't hypocritical. He is saying protect yourself from illegal hacking by bad actors, but submit to legal snooping by the government. Again, he might be wrong about wanting various legal means to snoop on people, but not hypocritical.
- derefr 10y ago
  Typical mind fallacy here, I think. I don't imagine the directory of the FBI gives one whit about "privacy." Instead, picture them spending all day thinking about "national security." Citizens have to tell the government everything—because doing so enhances national security. The government must not reveal anything to its citizens—because doing so would compromise national security. Pretty straightforward.
AndrewKemendo 10y ago
The FBI is part of the intelligence community. [1] https://www.cia.gov/about-cia/eo12333.html#1.7 https://www.cia.gov/about-cia/eo12333.html#1.7

dingo_bat 10y ago

I have never covered my Webcam because I trust the light to come on if the camera turns on. Is it possible to bypass that led?

mpetrovich 10y ago
Absolutely: https://www.grahamcluley.com/2013/12/webcam-spying-without-turning-led-researchers-prove-possible/ https://www.grahamcluley.com/2013/12/webcam-spying-without-t...
aboonaboo 10y ago
Absolutely
aboonaboo 10y ago
Absolutely short of the led being physically wired to turn on when the camera circuit gets power or something
statenjason 10y ago
If the light goes on, then it's too late.
1123581321 10y ago
Unless the camera and light are on the same circuit, it is possible to bypass the light via some software change.
tqkxzugoaupvwqr 10y ago
From a user perspective it is hard to know whether the webcam LED is software controlled. If it is software controlled, e.g. by the webcam driver, it is prone to manipulation and could remain off while the webcam is recording. Of course, there are many cameras that do not even have an activity indiator (LED), e.g. stand-alone cameras, or simply your phone front and back camera. I find it a good habit to cover all cameras, regardless of wether they have an indicator.
Steuard 10y ago
In addition to the attacks that others have mentioned here, I've also heard folks comment previously on the possibility of turning on the camera very briefly, just long enough for a single still shot. If it was done fast enough, the brief flicker of the LED might not be noticeable. (Like you, I had always assumed that the power for the webcam was literally in series with the LED, so that disabling the LED would render the camera inoperable. That seemed like the obvious way to do it if you wanted to provide a truly reliable signal. But evidently that's not the case.)

deleted 10y ago

[deleted]

6t6t6t6 10y ago

From all they ways I can be spied, the webcam is the one that concerns me the least. At the end, all they will see is a bearded man staring to the front. May they be able to see me naked? Well, probably, but I honestly don't think that they will make a lot of money by selling my naked pictures... My wife tells me that I still look good, but I suspect that she is being nice to me. What would scare more is that they manage to capture what is on my screen, or install a keylogger, or activate the microphones to hear my conversations, or that they access my hard disks and steal data, including my private keys. Hey, but putting a sticker on your webcam is a way to show how 1337 your are! I prefer not to have to bother removing stickers every time I want to do a Skype call.

rpgmaker 10y ago
On amazon there are cam blockers with a lid that allows you to block and unblock the cam.
eganist 10y ago
In fairness, you can still capture conversations from a webcam if your mark is speaking right in front of it, regardless of whether microphones are on.
- stephentmcm 10y ago
  Source? I'd hazard a guess that it's likely only marginally more accurate than lip reading?
  - bradbeattie 10y ago
    http://people.csail.mit.edu/mrub/VisualMic/ http://people.csail.mit.edu/mrub/VisualMic/
    - sillysaurus3 10y ago
      Interesting technique. This requires 60fps 1280x720 video. People would surely notice the slowdown. I wonder if it's possible to improve on this?

ipsin 10y ago

If you're so concerned about having your webcam subverted, it seems like the first step would be to insist on a hardware LED that can't be subverted in firmware. If nothing else, it would serve as a canary, indicating that your machine has been thoroughly compromised.

gkoberger 10y ago
And who do we trust to do that? More importantly, is it even possible?
- krastanov 10y ago
  In terms of electronics it is fairly trivial and it can be inspected by eye (or microscope) if the manufacturer decides to not encapsulate everything on a chip (which presumably would be the point of such a feature). Just have the only positive voltage rail going to the camera be the same one that is directly powering the LED. The firmware will be turning this rail on and off, hence turning the camera and the LED on and off simultaneously.
  - 1_2__3 10y ago
    Idle though on possible attack vectors: Convince the firmware to use a lower voltage, one that doesn't hit the breakover voltage on the LED but still powers the camera. Strobe the line, get snapshots without the LED doing more than very faintly glowing.
    - krastanov 10y ago
      I have a very hard time believing that the camera itself will not brownout in such a case.
    - umanwizard 10y ago
      LED activation voltage is less than what cameras typically require.

deleted 10y ago

[deleted]

mpetrovich 10y ago

But what about his computer's built-in mic? Unless he's pantomiming all sensitive info...

andrewflnr 10y ago

So the guy who decries "going dark" when it comes to encryption wants us to literally go dark with our webcams. It's like a dystopian comedy setup.

rdtsc 10y ago

This is like the coal burning power plant telling you to make sure to sort your recyclables into appropriate containers, to make the environment cleaner. Also people enjoy and feel good about accomplishing small things. Putting a sticker on your laptop is a small easy task. Do it and they feel more "secure" in an instant.

Hilyin 10y ago

I guess this is just as good place as any to bring this up. In current OS X, you cannot disable your mic. You can turn down the input volume, but never disable. All malware needs to do is raise the input volume and it can listen to you to its hearts content. And its worse with your iPhone.

the_common_man 10y ago
Can someone confirm if this is actually true? Sounds too far fetched that you cannot disable the mic (i.e not muting, I assume?).
- Hilyin 10y ago
  Just look around on the internet, you'll find the same thing. I researched this a few weeks ago and was amazed. You basically have to disable the audio driver in OSX to disable it, and doing that, means you can't play audio at all. And even that isn't enough, it technically can be hijacked at an even lower level.

sotojuan 10y ago

The webcam cover up is interesting to me because it's the only "weird privacy thing" I've seen regular, non-technical people do. A good amount of people at my university, most of which use social media liberally and don't care about encryption, cover their camera up.

smelendez 10y ago
It actually seems less weird to me in a university setting. Most university students live in small quarters, so they're more likely to have a computer in front of them while they're nude, using drugs, having private conversations or doing other private things. They're also around lots of new people of varying levels of maturity who could have a decent chance of getting physical or network access to their computer, much more than neighbors in the rest of the world. A creepy stalker or blackmailer spying on a university student through a webcam sadly doesn't seem that farfetched, especially for women.
wingerlang 10y ago
I think university aged women would be the most logical person to cover up their camera.
JohnStrange 10y ago
It's not weird at all. Women should definitely always do that, because they use their laptop everywhere, e.g. in bed, and there are plenty of viruses and trojans that activate the webcam for sextortion and stalking purposes.
pseudonymcoward 10y ago
This is only idle speculation but: A web cam resembles an eye staring at you all the time. This makes people feel weird, like something is staring at them. The threat to privacy is right in their face and on a gut level. That's the reason so many people cover them even when they won't take other basic online privacy precautions.
- Sylos 10y ago
  Also just in general, people understand what a camera does. It's much harder to understand the implications of abstract "data" going off onto the internet.

boxkite 10y ago

I keep mine covered because I work remotely a lot and I don't want to accidentally shirtless video chat someone from bed when I meant to make a different type of call.

3chelon 10y ago
It was unusually hot and I actually did that myself just the other day - embarrassing!

deleted 10y ago

[deleted]

whitenoice 10y ago

Just saw the prescreening of snowden movie with online live event with movie cast and snowden post movie, and this was exactly what was depicted in the movie and in the event talk.

skybrian 10y ago

Back in the day, SGI workstations had a hardware shutter. I still think it's a good idea.

white-flame 10y ago

I said it then, and I say it now: - Encryption is our webcam tape. That tape cannot be thwarted by any remote attacker, legally warranted or not. It's perfect, unbreakable security from webcam visuals being exfiltrated, exactly the security features that Comey says we shouldn't be allowed to have for our data.

pdkl95 10y ago
"What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity." ~ Philip Zimmermann, "Why I wrote PGP" https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html
- drvdevd 10y ago
  A brilliant point and a salient quote. Why must we continue to live, collectively, with our heads in the sand?
alanwatts 10y ago
It's not perfect if your endpoints are compromised.

stanislavb 10y ago

Hypocrite!

conradev 10y ago

I use a MacBook Pro as my daily driver, but I recently purchased a Lenovo ThinkPad to play around with. Sometimes I forget how awesome it is to have a repairable and modular computer. I didn't want the webcam or microphone in the ThinkPad… so I took 30 minutes and removed it. Easy as that.

csydas 10y ago
Well,to be fair you could just open the MacBook Pro and unplug the ribbon for the webcam. iFixit will have instructions. Removing it entirely granted is another matter, involving opening the screen, but you'd have to do the same on any modern laptop with an integrated camera wouldn't you?
- wruza 10y ago
  For my mac I just used a knife to open screen and shoved black paper strip before camera.

meltbuzz 10y ago

nice

neom 10y ago

It's pretty sad that he used the word "authority" in this sentence: You do that so that people who don’t have authority don’t look at you. I think that’s a good thing.”

mmaunder 10y ago

I wonder if he covers front and back cellphone cameras.

orthogon 10y ago

What about the part where we stop buying products with integrated cameras? What about the part where we stop buying devices that we have seeemingly no hope of control over? What about that? Is boycott a word too strong? Gee, you're right. We should all just give up, and accept that what we're sold, is that which we must buy.

deathanatos 10y ago
I think you're being a bit quick to judge people here… Having an integrated camera is obviously a lot easier to deal with, logistically, than lugging along an external USB camera. I think a lot of the people here would love to have hardware-level kill switches for their video camera. And mic. And WiFi. (I would; I used to own a Thinkpad with a hardware kill switch for WiFi. It was useful, even aside from the privacy benefits.)
- orthogon 10y ago
  I think you're neglecting a key detail: alternatives are hardly even on the shelves, and NO ONE QUESTIONS IT. > Oh, well, that's just supply and demand, of course! > Everyone just WANTS an always on internet connection! > Why would anyone ever remove the battery from their cell phone??? > It's more cost effective to build the device like that. Common sense! > Everyone wants a unique identifier, GPS and 911 service. It's safer! Yup, no one would ever want things any other way. It's silly to question why the invisible hand of the market works as it does.
  - derogator 10y ago
    The really amazing part about the downvotes here, is that HN is unable to reconcile the realities of mass surveillance that tend to conflict with profit motives, and yet the collective overtone of HN professes itself to be a bastion of progressive futurist space exploring tranhumanism. Few seem to notice the cognitive dissonance. Sort of a cruel prank. Those in the best position to release the yoke, are only motivated to tighten it.
- 10y ago

foobarcrunch 10y ago

Unless you're using Prey[0] and want an opportunity to photograph would-be crooks. [0] https://preyproject.com https://preyproject.com

greglindahl 10y ago

I experimented a bit with an Apple laptop microphone, and it took 2 layers of electrical tape to block the mic. There doesn't appear to be any way to block an iPhone mic without blocking the speaker, too, and I'm not confident that it could be blocked at all.

markyc 10y ago

in this day and age how come we don't see laptops carry a physical on/off switch for the microphone and camera?

exmuslim 10y ago
My laptop is long pass the warranty so I did it myself.
Shanea93 10y ago
This is the day and age of removing headphone jacks to make a phone slimmer, taking away your disk drive, etc. Most companies care more about aesthetics than functionality at this point.
- ojii 10y ago
  can I have a laptop without a webcam/integrated mic then?
  - soylentcola 10y ago
    How courageous of you!
dndln 10y ago
Purism has a laptop with 2 physical switches, and it runs linux too. https://puri.sm/librem-13 https://puri.sm/librem-13
pwg 10y ago
Some older laptops did have physical on/off switches for the wifi card (this was prior to the advent of a camera in every laptop). The old Dell D820 was one such laptop. That was likely not the only one. Gradually they were dropped from newer models because the manufacturers saw no sales changes due to the presence/absence of the switches (i.e., not enough purchasers refused to buy the "new" laptop because it dropped the physical on/off switch, which is the only feedback the makers truly understand and pay attention towards). And dropping the physical switch saved the manufacturer a small amount on each laptop, which when multiplied across the numbers built was either a nice profit increase or a small price reduction (or likely a little of both).

benevol 10y ago

Every electronic communication device (laptop, mobile, tablet, etc) should have 1 hardware switch per sensor (camera, mic, motion/acceleration, etc) which disables the sensor. Why manufacturers still haven't introduced this is beyond me.

dndln 10y ago
Here's a linux-running laptop that has 2 hardware switches: https://puri.sm/librem-13 https://puri.sm/librem-13
- bo1024 10y ago
  Wow, interesting, I didn't know about this.
pwg 10y ago
>Why manufacturers still haven't introduced this is beyond me. Expense and lack of demand. Some older laptops used to feature hardware kill switches for the wifi (this was prior to the advent of a camera in every laptop). The old Dell D820 model was one such laptop. Eventually they were dropped all around because from the makers point of view, the presence of the switch had no effect on the sales of the laptops. Anything you add to the BOM (Bill of Materials) for the device raises the final net cost, and there is still enough competition in the laptop/phone space that keeping the costs down is necessary to compete. Additionally, twenty-five cents per unit does not sound like much, until of course you multiply that by 10+ million units built (where a twenty-five cents difference per unit amounts to $2.5+ million difference in the end). So if having the switch or not having the switch made no difference in sales, the maker could either raise their profit, or lower their price (or more likely split the difference) by dropping the switches. The lack of demand is that not enough purchasers are telling manufacturers they want hardware on/off switches (the purchasers do this by buying only laptops with them, and by not buying laptops without them [which may be difficult to bootstrap now, given that almost no laptop has a hardware on/off switch anymore]).
- jcadam 10y ago

_Codemonkeyism 10y ago

"The head of the FBI on Wednesday defended putting a piece of tape over his personal laptop's webcam, claiming the security step was a common sense one that most should take." One needs to ask why is the head of the FBI telling you this? Cui bono? This is a red herring. The FBI has no interest in filming you through your webcam. They want to listen to your microphone, watch your screen, get the keys you've typed, see the websites you've visited, read the emails you've sent. Watch you on video? Nah. This is a red herring. That is the reason the head of the FBI tells you to cover your webcam. I wish the The Last Psychiatrist would come back.

tingol 10y ago
The FBI isn't telling you this so you could protect yourself from the government. They are telling you this because they know how easy it is for someone else to take control of the camera and make your life hard. So it is a common sense step for you to take if you're concerbed about security. You took a pretty huge jump from that to the FBI listening to your mic.
anjc 10y ago
I guess it's also in the interests of the US authorities that their country isn't subverted via normal citizens through blackmail.
severine 10y ago
It saves them bandwidth, too, doesn't it?
rurban 10y ago
Taking screenshots at exactly the same time when the observant is typing something into the very same laptop makes for undeniable evidence to the judge.
mattnewton 10y ago
I do think the FBI has a track record of infringing privacy and bending the law, but the FBI isn't always the boogeyman. Here they are probably actually trying to do their job, which includes protecting citizens from blackmailers and other baddies.

janvidar 10y ago

Isn't this really just a sign of flawed hardware design? In my opinion hardware should be designed so that the camera LED lamp should always be lit if the camera is used. If there is a malfunction with the LED, then the camera should also not work. Also there should be a hardware LED for when the microphone is being used which should work in the same fashion for laptops with built-in microphones. In the webcam drivers I have looked at the LED is controlled independently of capturing, although drivers do enable the LED when the camera is used. This essentially means that hackers can record and disable the lamp. I've been considering hacking together some piece of software that will continuously use the camera (/dev/video) in order to block it for other applications, and have it fail with visible alerts if unable to block the camera. Not sure if the same thing can be achieved for the audio recording devices due to multiplexing.

onion2k 10y ago
In my opinion hardware should be designed so that the camera LED lamp should always be lit if the camera is used. That would only inform the user that the camera is on, and that isn't good enough. If the user is paying active attention to the computer then they can take action, but if they're not then they can't - noticing an LED has switched on when you're busy doing something else in the same room is quite unlikely. Even if you're actively using the computer you could miss it if you're focused on a task. A hardware switch that disables the camera or a lens cover that blocks it entirely (eg tape) are the only safe options.
- Houshalter 10y ago
  The hardware switch won't tell you that your computer has been hacked. The camera light will. And a lens cover won't protect your microphone or your personal data.
  - dndln 10y ago
    If you are hacked, the camera light won't tell you. The camera light also won't protect your microphone or your personal data.

eosrei 10y ago

What about the cameras in your phone and the microphones in everything? Security theater isn't security.

xcasperx 10y ago

I agree with what most people are saying on here, but I believe there's a bigger picture to it. Let's say that your computer has been completely 'pwned', and that you are currently reading an article with an ad for Cow Porn, or whatever, on the right hand hand side of the site. The hacker can write some code to check what your eyes, and eyebrows, did when you looked at the ad. If it peaked your interest, the hacker can maliciously add more 'Cow Porn' ads to sites you visit - via swapping out the regular ones. Now one day you get curious and click on it, and boom they take a screen shot and try to blackmail you. This is obviously quite outlandish but think about purposefully planting posts, lets say on reddit, by switching out posts. They then look at your head movements, and, or, eye movements then boom, you're added to some list that you wouldn't have be added to if it weren't for your eye movements.

bobsoap 10y ago

Instead of a sticker, one could also use this clever, simple, magnetic gadget (not affiliated): https://www.kickstarter.com/projects/1893116150/nope-20-live-free https://www.kickstarter.com/projects/1893116150/nope-20-live...

bobsoap 10y ago
Seriously, downvoted without an explanation? That's quite poor. If something about my post offends anyone, I'd love to know about it.

listentojohan 10y ago

What I don't understand is why he has to defend it? (Yes, it might seem hypocritical.)

demonshreder 10y ago

Aren't these attacks primarily for Windows? Would using Linux (say Arch) mitigate these? Edit: Shouldn't we be more concerned about phones and tabs?

facepalm 10y ago
Nice attempt at humor :-)

SG- 10y ago

Anyone know what kind of laptop he uses?

codethief 10y ago

In case anyone's looking for something a little bit more sophisticated than a sticker to put on his/her webcam: https://soomz.io/detail/webcam_covers_a10 https://soomz.io/detail/webcam_covers_a10 Been using it for a while and it works like a charm. (Though on a phone it does tend to attract a bit of dirt and the color wears off over time. If you keep your phone in the pocket of your pants, that is.)

caub 10y ago

Laptops have a LED showing when webcam is in use

laurent123456 10y ago

This article describes how to turn off the led light on Windows, which is surprisingly easy: http://blog.erratasec.com/2013/12/how-to-disable-webcam-light-on-windows.html http://blog.erratasec.com/2013/12/how-to-disable-webcam-ligh... TLDR: Webcams follow the UVC standard and, according to this standard, the LED indicator light is controlled by the host software. So a simple hack is to find the webcam driver DLL, find the function that controls the LED (such as TurnOnOffLED()), make it return immediately, done.

pjc50 10y ago

Previously: http://www.independent.co.uk/life-style/gadgets-and-tech/yahoo-webcam-users-intimate-images-intercepted-by-gchq-spy-programme-snowden-files-reveal-9158140.html http://www.independent.co.uk/life-style/gadgets-and-tech/yah...

chrischen 10y ago

Quick question for HNers: why isn't something like the camera insicator light implemented for the microphone?

throw2016 10y ago

The hacker news readership is focussed on startups and technology. It's a career, a business and in some cases an interest in technology. So privacy as a social good may not be the primary perspective and it often devolves into how this affects readers personally rather than the society they live in or side tracks into technology nuances. Technology is enabling new negative possibilities but it does not follow that technologists can make a difference. There is no ethical code of conduct. Like everyone else they are another cog in the wheel and software engineers may not have an interest or priority on privacy, social and political issues. There are a large number of folks working in the nsa, gchq, google, facebook, palantir, hardware vendors and elsewhere actively enabling this. Like technology itself politics, liberty, privacy and the evolution of modern system from the time of feudalism requires interest and priority. From this perspective the need to tape up your webcam may have completely different ramnifications.

zelos 10y ago

Didn't all Sun webcams used to have little irises that you could close on them? It seems like a sensible precaution: makes it less likely I'll accidentally log into a company conference call in my dressing gown with my camera enabled.

wickedlogic 10y ago

Please cover your webcam, it is distracting while we are trying to listen to what you are clicking on.

awesomerobot 10y ago

Also remove your microphone and don't use a keyboard? If I were hacking you I'd _much_ rather log your keystrokes or hear what you're saying. The number of scenarios where having a visual would be useful would be incredibly low by comparison. Putting a sticker over your webcam is like putting a lock on a screen door.

maxerickson 10y ago
Most screen doors I can think of do have locks. Even quite home made ones often end up with a hook that kids can't reach.
- awesomerobot 10y ago
  That's my point. It does one thing, but it's by no means security.

24gttghh 10y ago

My Asus 1015PEM netbook from 6 years ago has a physical screen that slides over the camera; sliding the screen also turns on the camera. Why don't more laptops have this feature if this is such a 'big deal'?

piedradura 10y ago

I prefer to have a computer composed by parts, so I attach the webcam to the computer when I need to, same thing for the audio and many other applications. I only need 1k of ram to send a secret message, so no virus or malware could be in my tiny computer.

tedmiston 10y ago

Does anyone feel the need to cover their iPhone front facing camera?

e1ven 10y ago
Yes. I cover both the cameras on my phone with tape, and only remove it when I want to take a picture. That said, I have a lot more faith in the security of a whitelist-based model like the App store, versus the blacklist model of a PC with antivirus.

mangeletti 10y ago

I swear this is a true story: I worked at Staples when I was 19, and when I first started I was a "front end lead" (read: the only full-time cashier), so I would work behind the service counter at the front. Once, I was standing up front while there were no customers when all of the sudden the voice of the general manager (we'll call him Bill) popped onto the phone's speaker, "Hey, Michael". I looked up and noticed the light next to "Manager's Office" was on. I instinctively replied, "Hey, Bill; what's up?", despite the fact that it nearly gave me a heart attack. Bill proceeded to tell me to run something he needed to the back, which I did, and that was the end of that. Then, one day I was helping a customer with some Cross pens behind the counter. I stood up to grab a key that was next to the register when I noticed out of the corner of my eye that the phone's "Manager's Office" intercom light was on. It made my heart jump because I hadn't talk to anybody through it, and I knew that Bill was in the back office. I immediately realized, 'oh my god, he's probably spying on me to see how my service is!'. It made me feel uncomfortable, until I realized it was an opportunity to be extraordinarily helpful and jovial with the customer and be "candidly" observed by my manager. So I did that. I rang the customer up and she left. The light went off after a few minutes of silence. After that, I noticed the light come on a number of times on different days, which surprised me. I even ran to the back after helping a customer once, while the intercom light was still on, sneaked around the corner, and looked into his office window to see if it was really him. He was sitting there looking at his phone. I looked for just a moment when I heard from the speaker above, "<beep!> cashier to the front". I ran. Bill was probably the greatest manager I've ever known, such a hard worker, a really cool guy to talk to, well respected by everyone, etc. In fact, if all managers were like him, Staples would probably still be a force to be reckoned with. So, it never bothered me the way it probably would have, had it been some creepy manager. This is necessary for the rest of the story, because had it not been the case, I would have probably called him out, etc. Eventually I started being extra jovial all the time, because I never knew when I'd miss seeing the light come on and miss the opportunity to impress Bill. Bill was so impressed with my service that I was given a raise and promoted to manager of the copy & print center about 6 months later, which eventually led to me opening my own print company and quitting Staples (after seeing how high the margins were), which led to me learning how to use Adobe Creative Suite and graphic design, which led to me shifting my focus to print design for clients (brochures, cards, etc.), which led to me meeting some guys who ran an Internet marketing company one day while trying to sell my print design services. They wanted to hire me full time, and did, so I began learning web design, then web development, then back end code, etc. I always tell myself, 'I was probably destined for this kind of work', but the reality is that my entire life might have been changed by simply knowing I was being spied on by my Boss. I realize that it probably worked out for the better in my case, but the fact is, knowing that somebody is watching you causes you to change who you are. It's a form of control in and of itself. In fact, it doesn't even need to happen to you. Now that we have all seen that the government does spy on people, it's hard to imagine all the tiny ways that it might change your behavior and the things you say (e.g., online).

lovedj 10y ago

I'm more scared of them capturing what's ON the screen.

ssebastianj 10y ago

I was looking for a way to cover the mics and webcam integrated in my laptop which doesn't require a tape. So, I grabbed a couple of those magnets stripes usually found on fridges and then , using a scissor, made two little rectangular stripes and a larger one. Next, I glued the little stripes on the laptop, near close the mics. The nice thing is that the large stripe covers both, the mics and webcam. For me, it's an easy way to cover/uncover fast.

JustUhThought 10y ago

At some of my house parties I require guests to check their phone at the door. Price of admission. (I keep a landline and am ok with giving that number out as an emergency contact number). Boy does this get the conversation started. I can tape my phn camera, but what about the other 20 phns in the room? I have no control over them to keep them from posting photos of me drinking or whatnot during a party, photos I do not want online. From the tin-hat perspective one must do (much) better than consider their personal devices. One must consider all devices in their personal proximity .

GarrisonPrime 10y ago
It'd be amusing to have a little Faraday cage by the door for them to deposit into. :)

throwaway13337 10y ago

It's relatively common to have access to private security cameras. Some are even google indexed. The software included relies on the users protect the web interface. Obviously, this is the vulnerability. Especially with things like default passwords. Here's an article about it: http://www.networkworld.com/article/2844283/microsoft-subnet/peeping-into-73-000-unsecured-security-cameras-thanks-to-default-passwords.html http://www.networkworld.com/article/2844283/microsoft-subnet... A lot of these cameras are controllable and have speakers. People now do live video streams of pranking people through this means. Pictures: http://imgur.com/a/0WImd http://imgur.com/a/0WImd

krinchan 10y ago

I'm about to die laughing at the hoops people are jumping through in the comments to claim they've never pulled up some porn and enjoyed themselves in front of their laptop. Ever. EVER