3 ms·

This isn't so much about the "threat" in terms of candidate devices which could act as bugs, or wifi devices in general (which aren't unusual, these days) but a

by theoh 8y ago

This isn't so much about the "threat" in terms of candidate devices which could act as bugs, or wifi devices in general (which aren't unusual, these days) but a question of whether the convenience being provided to guests is actually far outweighed by the risk that's being created for the "host". I'm not talking about paranoid hosts; it's more that a system shouldn't pretend to offer security of any kind when it actually doesn't. Edit: so the threat is all the potential downsides relative to sharing wifi passwords on paper.

dragonwriter 8y ago
What it protects against is casual people outside the home, with no intrusion, connecting to the Chromecast. It's casual vandalism that would be easy with the direct connection Guest Mode without the PIN, but which the PIN pretty effectively defeats (provided the screen isn't visible to outside passerby.) > whether the convenience being provided to guests is actually far outweighed by the risk that's being created to the host. What risk? If you are in my living room or compromise an internet-connected device there, you can stream to my Chromecast, sure, but you can do a lot worse with those preconditions independent of Chromecast Guest Mode.
- theoh 8y ago
  The process of pairing two Bluetooth devices, for example, usually needs physical input on both devices. This setup weakens that requirement, and it's unclear why, other than convenience and gimmickry. One possible risk is that streaming video to the Chromecast could be used to exploit security flaws in the video codec. That might sound like a stretch, but you're increasing your attack surface. Where previously, the host would have had to intervene to accept a stream, now there's this weak audio-based security system. However minor the possible risks to the Chromecast are, this method of authentication just seems to be asking for trouble.

by theoh 8y ago

dragonwriter 8y ago

What it protects against is casual people outside the home, with no intrusion, connecting to the Chromecast. It's casual vandalism that would be easy with the direct connection Guest Mode without the PIN, but which the PIN pretty effectively defeats (provided the screen isn't visible to outside passerby.) > whether the convenience being provided to guests is actually far outweighed by the risk that's being created to the host. What risk? If you are in my living room or compromise an internet-connected device there, you can stream to my Chromecast, sure, but you can do a lot worse with those preconditions independent of Chromecast Guest Mode.

theoh 8y ago
The process of pairing two Bluetooth devices, for example, usually needs physical input on both devices. This setup weakens that requirement, and it's unclear why, other than convenience and gimmickry. One possible risk is that streaming video to the Chromecast could be used to exploit security flaws in the video codec. That might sound like a stretch, but you're increasing your attack surface. Where previously, the host would have had to intervene to accept a stream, now there's this weak audio-based security system. However minor the possible risks to the Chromecast are, this method of authentication just seems to be asking for trouble.