5 ms·

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the tech

• whatshisface 8y ago
  There was a security breach. The product was operating outside of the behavior range that the parents were told about. If I tell you that my toaster will not catch on fire and then it burns your house down while you use it as instructed, I can't argue that you "didn't understand" its behavior - sure, you didn't predict that it would self-immolate, but is it really your job to reverse-engineer my product to check for poor design?
  • volfied 8y ago
    It is not the toaster company's responsibility to make sure no one gets in your house and puts a fork in your toaster and leaves it running.
  • shawnz 8y ago
    Being able to access the camera remotely given the correct password is absolutely within the behaviour range that users are told about. It's the entire point of the product. Do they want remote access or not? If so, then it's the user's responsibility to provision that access appropriately. Passwords and 2-factor might be too complicated for some, but what else do we have?
    • whatshisface 8y ago
      >We have seen instances where a small number of Nest customers have re-used passwords that were previously exposed through breaches on other websites, and made public. None of these breaches involved Nest. This exposes these customers to other people using the credentials to log into their Nest account. Subtly, Nest did not actually claim that the attacker had a correct password. For all we know this instance was a breach.
      • shawnz 8y ago
        Of course they are not going to give specific details about a particular customer's security incidents in a public statement. And of course they can not publicly claim that they've never had a security breach because it's impossible to know that for sure. I'm not sure how they could make the statement any more specific than they already have.
  • idle_zealot 8y ago
    My understanding is that the password was compromised. It is well within expected behavior for Nest to allow someone with the right credentials to access the connected cameras etc. This isn't a matter of expecting the consumer to reverse-engineer their product and perform a security audit before allowing themselves to trust it, it's a matter of expecting the consumer to understand what credentials are.
  • warent 8y ago
    Your analogy implies that compromised IoT devices are some rare statistical anomaly that nobody could possibly predict ever happening.
    • darpa_escapee 8y ago
      Your reply implies that consumers have a deep understanding of an industry that's outside of their areas of expertise.
• smacktoward 8y ago
  I must have missed the part in the Nest manual where they told you to expect complete strangers to be able to watch you and speak to you through it.
  • bluetidepro 8y ago
    Actually, that is in the manual. That's a feature of the product. You can watch and speak through it. Just because a stranger got your password from an unrelated security breach to Nest, doesn't make it Nest's fault. They have the tools available, and even encourage you in the setup process to setup 2-factor (I just recently set one up). Outside of that, this is user error, in my opinion. Nothing was "hacked" on Nest's end.
    • deleted 8y ago
      [deleted]
  • christophilus 8y ago
    It's the part that talks about how there's a camera and a speaker on an IoT device that's connected to the internet. Seriously, though, my neighbor's entire house is wired up. His lights, his camera / security system, his shades, his music player, his TV... just about everything is integrated into Alexa. It boggles my mind why an otherwise intelligent person would do this.
    • cgriswald 8y ago
      It's crazy to me that this is the way things are, and that a lot of these companies charge a service fee for remote access. A better way would be VPN offerings for the home from ISPs, and the devices working only locally.
  • kodablah 8y ago
    I also missed that in the Facetime manual.
  • esotericn 8y ago
    A camera pointing at your face should be assumed to be turned on and recording you. A camera pointing at your face hooked up to the Internet should be assumed to be broadcasting that information to the world. We know this intuitively. Humans dislike eye contact from strangers because of what it implies. Cameras don't hit the same basic reflexes (likely because we've optimized them that way). If we haven't done a good enough job of educating users on that, we need to address it. The UK Government run cybersecurity adverts occasionally. I don't think they go far enough. I tell everyone I encounter to assume the worst case unless proven otherwise. The purveyors of a commercial product aren't going to detail these things unless forced. See 'everything else ever' - food, drink, medicine, ...
• volfied 8y ago
  If a company forces two factor authentication, people will go to a product without it, because it's easier. It's easier to blame the product than bad security practices because no one is getting trained on these. I think the real solution will be for Android and iOS to eventually have 2FA so integrated that any app can use OS APIs to implement it.
  • noir_lord 8y ago
    Authy is pretty impressive in that regard, I used it for the first time with twilio the other day and was impressed. Not affiliated with either company.
• markovbot 8y ago
  Company lied to consumer that this wouldn't happen. Then it happened. And you're blaming the consumer?
  • bluetidepro 8y ago
    Huh? Where do you see anything about Nest telling the consumer this wouldn't happen? They even encourage 2-factor in the setup process of the camera. I've never seen Nest say anywhere that the camera is 100% secure.
  • freehunter 8y ago
    Really? Google promised these people that if someone else used their correct username and their correct password, that other person wouldn't be able to log into the Nest camera? I didn't see anywhere in the article that says Google promised that, and from what I know of security that's impossible. The article did say Google offered a way of increased security, an answer the consumer neglected to use and says isn't enough. (edit - says with absolutely no knowledge on the subject that 2FA isn't enough) In your opinion, what should Google have done differently here? And where did you see that Google promised no one would be able to log in if that person had the correct username and password and 2FA wasn't enabled?
• sp332 8y ago
  Tech is still in wild-west mode. I can buy food and eat it without testing it for poisons first. I can put my money in a bank without doing my own routine audits of their security. Like nutritional labels on food or a "Schumer box" on a credit card app, maybe we could list some risks and mitigations that the user needs to keep in mind when using the product.
  • ribosometronome 8y ago
    Just because food is poison free doesn't mean it's consequence free. Most people just have a better understanding of food and it's consequences (feeding babies Burger King is a bad idea) when compared to tech and its consequences.
• excalibur 8y ago
  > I just can't comprehend simultaneously having children and not understanding technology. Are your parents tech wizards? How about your grandparents? Generational differences aside, pretty much everyone is clueless about some aspects of technology. You call yourself tech savvy, and I don't doubt you're correct, but I do doubt that your knowledge has no holes. Mine has plenty. And of course the general population's knowledge skews much thinner than HN readers. Many are on the Internet nearly every day of their lives, but ask them about something outside of the few select apps they use, and you're greeted with blank stares. Whether or not they have children is pretty much irrelevant. Giving birth may trigger some instinctive behaviors that come with a certain functional knowledge, but the layers in the OSI model aren't generally included.