13 ms·

The voice from our Nest camera threatened to steal our baby

194 points by Balgair 7y ago

infinitezest 7y ago
> It is not evil to bring a product to market before the privacy has been completely figured out, but it is evil to let someone threaten to kidnap an 18-month-old and have no real response. I have to disagree with the first part here. Privacy is a pretty central (and I would say _obvious_) concern, especially given the function of this particular product. I get that some people care less about privacy than others but the fact that this tech is being misused like this doesn't seem surprising to me at all.
- not_a_cop75 7y ago
  True. Otherwise the "Internet of Things" becomes the "Botnet of Things" as time has already shown. However, once a botnet is used for sex trafficking, it's sure to be taken much more seriously.
Cpoll 7y ago
> Essentially, an email and a password are compromised somewhere across the internet. They join millions of other email addresses and passwords, which are then cross-referenced with other websites, including Nest. This doesn't sound like a Nest vulnerability? Does Nest offer MFA?
- ollie87 7y ago
  Yeah, this has absolutely nothing to do with Nest and everything to do with people using the same passwords for different sites.
  - toomuchtodo 7y ago
    Does Google/Nest partner with haveibeenpwned to invalidate leaked creds and force a reset by the user? Forcing MFA would also not be unreasonable considering the sensitivity of the data collected (ie video in your home), although I get this is up for vigorous debate between product, security, and engineering. Google defends Gmail users from malicious nation state actors [1]. Isn't Nest part of the Google identity ecosystem now? [1] https://security.googleblog.com/2012/06/security-warnings-for-suspected-state.html https://security.googleblog.com/2012/06/security-warnings-fo...
    - stedaniels 7y ago
      I didn't think HIBP did password hash sharing?
      - deleted 7y ago
        [deleted]
      - deleted 7y ago
        [deleted]
      - cartoonworld 7y ago
        They sure do and in fact offer an API for sites to validate sha-1 hashes against their cracked password DB[0]. The hashes are shared. Thank you to Troy Hunt [0] https://haveibeenpwned.com/API/v3#PwnedPasswords https://haveibeenpwned.com/API/v3#PwnedPasswords
        stedaniels 7y ago
        That's not really what I was getting at. I've implemented the password lookup before. That protects users from setting passwords that have already been compromised. The scenario I was looking at was.. User signs up with Site A with Password 1. User signs up with Nest with Password 1. Site A gets compromised. Nest couldn't know if you'd used the same password on each site. The only way they could know is if they used the same hashing algo with the same salt or SHA-1 with no salt. Highly unlikely. I suppose Nest could check the Pwned Passwords API every time they logged in, but I haven't seen anyone deploy that yet, IIRC all solutions I've seen check Pwned Passwords API when the set the password. Setting a password and checking a password are often different systems.
        cartoonworld 7y ago
        you can also download the passwords
    - Ajedi32 7y ago
      Google has their own system for detecting compromised passwords: https://www.blog.google/technology/safety-security/password-checkup/ https://www.blog.google/technology/safety-security/password-... I have no idea if it's integrated with their primary login flow though. It's certainly integrated with the password manager in Chrome.
  - ithinkinstereo 7y ago
    Yes, but that is a pedantic technicality that misses the point. Google markets Nest's ease-of-use and plug-and-play simplicity to non-tech users. That's a critical piece of the product's value proposition: that it just works and you don't have to think too much about it. For user security not to be a major design consideration from the onset seems extremely shortsighted... especially since this is an internet-connected camera that you're placing all over your home. Not thinking about security and privacy implications was Google's first failing. The second failing is its broken culture when it comes to customer support.
  - codesushi42 7y ago
    Nope. One easy fix. Send a verification email to users when a different device is detected before allowing log in. I mean, even Steam does this.
- basseq 7y ago
  Yes, Nest offers MFA. You should enable it now: https://support.google.com/googlenest/answer/9295081?hl=en https://support.google.com/googlenest/answer/9295081?hl=en
- sco1 7y ago
  > Does Nest offer MFA? I don't remember what Nest used before being bought by Google (I believe SMS MFA was available), but they're transitioning accounts to sign in with your Google account.
  - marklyon 7y ago
    But, if you transition, you lose some significant existing functionality and integration.
- _iyig 7y ago
  Yes, Nest has offered MFA for years. The blame for this incident falls squarely on the user, who reused the same (weak?) password across multiple websites without enabling MFA.
  - lultimouomo 7y ago
    One the one hand I agree the specific issue is the user fault. On the other hand, you're selling internet controlled audio and video recorders to the general public. What did you expect?
    - _iyig 7y ago
      Every single day people crash cars, cut themselves on kitchen knives, and choose weak methods of single-factor authentication. There’s only so much the seller can do. We’ve seen how much users love (and subvert) “strong password requirements.”
- NinoScript 7y ago
  IMO, the device should require MFA to be configured before working, using it without one should be left at most as an “advanced setting”.
- _bxg1 7y ago
  Yeah, I clicked this assuming (with a bit of surprise) that Google's IoT device security is as paper-thin as all the rest, but this was 100% user error. I don't know what he expects Google to do about it.
- AdamJacobMuller 7y ago
  They offer MFA, only via SMS. Not perfect, but, its decent. I still use it and will continue to do so until someone releases a better ecosystem. Right now I get an alert on my phone if someone rings the bell, or leaves/removes a package. Plus with facial recognition I get alerts which include the person's name for common visitors (via facial recognition) and will announce visitors via a set of google home minis. Nest will alert my phone if the smoke detector sees smoke or CO. I'm obviously quite "all in" on their ecosystem. I also will note I have an elderly relative at home as well as 3 dogs and we are not there most days so the ability to see what's going on at home and potentially take action like calling the police/fire/EMS is extremely valuable to me.
- linsomniac 7y ago
  I've gone "all in" on turning on MFA, preferring TOTP when possible, over the last ~6 months. A surprising number of sites that really should do not offer any MFA. Like bank accounts, credit cards, investing accounts, payroll, cars... My money may not be safe, but at least my github commits are!
- _Microft 7y ago
  People reusing passwords and email adresses is a known problem and not rare at all. So deal with it, i.e. you need to make sure that your service can not be affected by a simple leak. Not doing so means putting the security of your users and their experience with your product into the hands of other people (everyone who knows the email and password combination of your user). Ideally, being susceptible to a leaked password-email-combination should be considered gross negligence.
  - dwild 7y ago
    > you need to make sure that your service can not be affected by a simple leak How can you use any service then if in your mind any service should be be able to not be affected by a leak? My username/password combo is everything I need to use my account fully. Should there be another factor to use my account? I should be forced to get set another factor to post on HN? This is just absurd. We just can't keep increasing road block to let people not learn how to use something. There will always be an idiot to outsmart you.
stanski 7y ago
I wonder if Google execs are regretting the original "don't be evil" slogan yet.
- me_me_me 7y ago
  They dropped it long time ago.
  - stanski 7y ago
    I realize they dropped it but it's not stopping everyone from referencing it every time there's negative publicity.
- xiphias2 7y ago
  I don't think so. When I joined Google a long time ago I really believed that they are honest. They were actually very different from other companies at that point in time. It's just harder to be not evil when margins are shrinking.
- tempodox 7y ago
  I wouldn't drop a slogan that forces attacks of convulsive laughter (like “don't be evil” does coming from Google). There is no such thing as bad publicity.
- anigbrowl 7y ago
  Why? It's not like it has guided them for a long time, but still provides a useful distraction for the naive.
_-___________-_ 7y ago
User used same credentials for multiple sites. User did not use multi-factor authentication. Another site was hacked and the credentials exposed. Someone used those credentials to log into user's Nest account and access the speaker. User is upset at Google for some reason.
- bluejekyll 7y ago
  Well, maybe given that this is a security product Google should require rather than just encourage MFA. In that sense Google could make the security stronger for their customers but chooses to make it easier to install and use for the majority. Getting downvoted for this, but consider this: they require a password for security purposes, why don’t they require MFA? Why is this not a requirement for this product or all their products? It’s a barrier to entry, and an eases of use thing, which means it’s a product decision to not require stronger authentication on this or all their products.
- sp332 7y ago
  Google needs to do incident response on this. And get law enforcement involved.
- Maximus9000 7y ago
  Would it be possible to do something like this: 1. user Initially creates login and password for Nest device 2. Before Nest accepts your password, it checks HaveIBeenPwned.com to see if that password has already been used before for this email address. If so, the password is rejected.
  - dublinben 7y ago
    It's not only possible to do this, but should be expected for any security product. Nest is equally at fault here for allowing a user to use a known-breached password.
- vezycash 7y ago
  Blaming the user alone is crazy. If I login to my gmail account using a different PC, google won't let me in without sending a text to my phone or a code to my email. Sometimes, even using a different browser on the same PC I typically use triggers this security check. Even after letting me in, Gmail will send a notice of the strange login to my backup email - the mail will contain the time and ip of the event. Same with telegram. Loging to a new app/device and Telegram will sends the notification to the two apps I use on my main PC, my secondary pc, and my phones. Deleting the notification on one client app won't remove it from the rest. This way, an intruder can't erase the evidence. Also, almost almost every other email service I own badgers me to set up 2factor - either another email, a phone, back up codes or 2-factor authenticator apps. If Google/Nest isn't doing this - then, part of the blame lies with them. These basic, obvious, common sense security/password practices you know is breaking news to "NORMAL" people.
teslaberry 7y ago
What about if its a robot AGI testing humans. And what if the AGI is planning on using sentient physical robots to kidnap the baby? And WHAT IF, that robot is going to be the next robot. Solf and marketed by google amd amazon as you home security robot designed to prorotect your beby from being kidnapped. Its the robots!!!!!
nkrisc 7y ago
How could Google have prevented this except by requiring MFA? Even that isn't guaranteed to prevent 100%. I'm no Google apologist, just a pragmatist.
- sp332 7y ago
  It's not about the incident happening, it's about the response. If you know there are criminals on your network you should work to remove them.
- jawns 7y ago
  A couple things just off the top of my head ... * Detect that a login occurred from an unrecognized IP and email the account holder to tip them off. * More stringent password requirements and a check against public leaked database registries to alert the user that the password they're using has been leaked. But it seems like the bigger frustration is not that they did not prevent it, but that when it occurred it was difficult to raise the issue, and the response was tremendously inadequate.
  - giarc 7y ago
    The issue with your first suggestion is the whole idea of signing into your Nest account is that you are away from home, therefore your IP would be different. Not saying they can't do it, but accessing your device from a different IP is kind of the point.
    - nicpottier 7y ago
      Sure, but then you just log into your email and click a link and then you are in. Lots of sites do this and it would prevent this kind of attack in most cases. (assuming the leaked password was not also reused in email, but then you are in for an entirely different level of hurt anyways)
whoisjuan 7y ago
Well, this is a case of stolen credentials...but the behavior behind this is just a sample of how fucked is this world. Who in their right mind enjoys distressing others in that way? I try to convince myself that there's hope for the world but when I hear about this type of things I lose that hope. There are legit evil people in this world.
- dwild 7y ago
  > There are legit evil people in this world. There's 8 billions people in the world. There's every kinds of them. The commons one aren't interesting, they are commons, they aren't the one that we want to talk about. Thus what you see are only the best or the worst. Please don't lose hope because of that.
jimrandomh 7y ago
A lot of comments here are blaming the user for using the same username/password on multiple sites, allowing their account to be compromised. This is missing the point. Nest cameras are a security product aimed at non-technical users, so of course this happens frequently, and of course this was foreseeable at the very earliest design stages. The designers needed to come up with a solution to this problem, and blaming the user is not an acceptable excuse. The solution is actually pretty easy: require a pairing procedure that can't be done remotely. For example, the Nest app on a phone could display a QR code with is public key fingerprint, which you show to a camera, and the camera will only send video to phones it's been paired with. That would pretty much completely eliminate this failure mode.
- wrs 7y ago
  So every time you add a camera, everyone in the family/workplace has to go find it and physically pair every one of their devices with it? That doesn’t sound workable.
  - uhoh-itsmaciek 7y ago
    Doesn't it? Compared to the nightmare described in the article?
    - CobrastanJorji 7y ago
      I see this idea being proposed in an early design meeting. Then I see a product manager seriously consider it and then veto it. Why? Because their product's goal is to be the easiest to use camera system, and this makes using it much harder. But let's say the PM and the rest of management was convinced. So they make it require pairing and send it out for field testing. Field tests come back: "it's really annoying that I have to pair all of my phones individually with each camera." Management tells engineering to fix that. But let's say that the engineers once again convince management that this is a good idea. The product is launched. The review from CNET or Wirecutter or something comes back: "it's crazy in this day in age that I need to get a ladder and go around to all of my cameras to introduce them all to my new phones every time I do my yearly iPhone upgrade." CEO now has a crisis and demands this be fixed. Engineer pushes back again and is probably fired this time. Feature is removed. A few years later, this article comes out and it causes much, much less damage to the brand than the bad usability reviews. Everyone learns the wrong lesson.
danielovichdk 7y ago
Who would ever in their wildest dreams have devices from a huge data collections company, watching and listening in your home? It's beyond uintelligent, i you really think about it.
- vezycash 7y ago
  You read HN. So you're one of the few people on this planet who have even heard of the term "huge data collections company" much less have an opinion about it. In the mind of the populace, I think Google might stay in the same brain spot reserved for father christmas. I would have suggested a massive privacy awareness campaign but I doubt it'll work - especially when it comes at the cost of convenience.
- deleted 7y ago
  [deleted]
- dylan604 7y ago
  Sure, to the average HN user, if even that. As a thought experiment, you know the inner-workings of G. Take one step back, and consider if your parents have that same understanding. Sure, you may have talked about it with them at dinner once/twice/often, but do they really understand it? Now, multiply that by the greater majority of people that have no-tech understanding nor friends/family to enlighten them. To them tech might as well be magic. Everything is "push a button, get a prize" mentality for end-user tech now.
  - davengh 7y ago
    Arthur C Clarke's Third Law: "Any sufficiently advanced technology is indistinguishable from magic." My in-laws are firmly in the "computers are magic" camp. Say what you like about they should learn etc, but they're in their 80s, have already lived through multiple technological revolutions, and at this point don't have the energy or interest to work through another one.
    - dwild 7y ago
      Would your in-laws would let a kid play with power tool too? They are aware that someone not able to understands the danger of power tools and how to use them safely shouldn't use them. That's nothing new. Yet they still do...
mcnichol 7y ago
Putting it on the company to stop you from not doing things that make you prone to the most common and low-barrier password stuffing attacks? People reusing passwords is risky and frankly stupid behavior. The same way you are responsible for your financial identity and can be taken to court over these disputes, you are also responsible for your cyber identity. The longer you avoid being held responsible, the worse the pain will be.
rjkennedy98 7y ago
I had the same response from Google when my mom got hacked and she paid off hackers $6000 in Google Play cards. Why does Google allow people to be scammed via their gift cards when they could easily fix this by putting in basic checks? Crickets. Its easy to say 'my mom should know better', but like most users in the world she is not technical. She grew up on a farm, how is she supposed to understand this stuff. It should be on these companies that make enormous profits to protect all users. This includes users who are not technical.
- markstos 7y ago
  I grew up on a farm. We lived in a barn at first. I know this stuff. I hope you helped your mom set up 2FA after that. Would basic checks would you recommend that Google on top of offering a robust 2FA solution?
  - rjkennedy98 7y ago
    Here are few things they could do: * ensure that where they sell gift cards there are store limits on how many gift cards can be bought. * track the usage of the card to make it more difficult for criminals to use them. * put a day delay on the card or make the user register to make it more difficult for the user to immediately sell the card off to criminals Google is very aware that their gift cards are used in massive fraud schemes of millions of dollars that target the most vulnerable (the elderly). It is similar how there is a huge fraud scheme build on Nest products. That they allow it to happen (as it is of no cost to them) is incredibly irresponsible and in opinion even criminal. When I called Google, their response was that on the back on the cards there is warning in small print that if you give the scratch off key, the money is unrecoverable. As if someone being told that their entire life will come down crashing around them if they don't send the money is going to read the small print on a gift card! Google is probably the company in the world that is the best at tracking users and cyber security. There is no reason why they couldn't prevent these use cases if they put effort in.
- driverdan 7y ago
  > She grew up on a farm, how is she supposed to understand this stuff. I'm sure it wasn't your intention but that's quite insulting. Just because someone didn't grow up with technology doesn't mean they can't learn and understand it. Farmers especially since they're very DIY and resourceful.
giarc 7y ago
CanadaPost is resetting all user passwords now due to a similar breach [1]. "The cause appears to be that login and password credentials stolen in external privacy breaches unrelated to Canada Post were used to access individual Canada Post accounts. This is possible when users reuse their credentials on several websites to avoid having to remember different passwords." I'm not sure how they plan to prevent users from just reusing another password, however perhaps this education will help. 1. https://www.canadapost.ca/cpc/en/our-company/news-and-media/corporate-news/closures-and-service-interruptions-details.page?article=2019/10/16/canada_post_is_reset&cattype=announcements&cat=updates https://www.canadapost.ca/cpc/en/our-company/news-and-media/...
- ficklepickle 7y ago
  Canada Post doesn't sanitize user input very well. Username/password is reflected unchanged in JS. Got a console error because my password has a single quote in it.
jakobegger 7y ago
Many services send you an email when someone logs in from a new device. Does Nest not do that?
hartator 7y ago
> it was the user’s fault for using a compromised password and not implementing two-step authentication Very low technical skill for someone writing for a website called siliconvalley.com.
keiferski 7y ago
If you leave your front door unlocked and someone robs your house, is it the door manufacturer’s fault? Genuine question, it is interesting that one product has certain expectations while another doesn’t.
- 4ntonius8lock 7y ago
  Exactly my thought. All this anger is so weird to me. I think the super angry response we are seeing is a result of the authoritarian lean of our current times. It's like the concept of freedom IMPLYING responsibility has been completely done away with. The operating concept is: adult consumers are children, and need to be protected.
- lawn 7y ago
  A better analogy would be buying a door that might unlock at a random time during the night, if you didn't use the right motion when you locked it.
- defen 7y ago
  People generally have an intuitive understanding of the security properties of doors. On the other hand, my mid-70s in-laws still have not internalized the idea that the threat model for bad / reused passwords is not "some guy sitting at a computer randomly trying passwords". A better example for the door analogy would be that you leave it unlocked so you can grab something out of the car in your driveway, and by the time you get back someone from Russia has taken all your stuff.
rezmeplease 7y ago
bruh
ben7799 7y ago
On top of having to fail password/2FA security basics for your kid to be subjected to this you have to: - Have both parents decide the child is not a high enough priority for one of them to stay home - Decide it's too much hassle to take the kid to a professional style day care where there are multiple adults watching each other to make sure none of the adults are badly behaved with the kids - Also too much of a hassle to go to a home day care where less professional adults could watch the kid, but at least there are more than one of them working there in case one of them starts to mistreat the kids - Hire a nanny, but not trust the nanny, cause sometimes nannies are badly behaved too - Decide you trust the IoT company more than the nanny or any of the above First world 1%er problem for sure.
- 0xfeba 7y ago
  I hate to break it to you, but nannies and nest cams do not automatically place anyone in the 1%, or 10%, or 50%.
cbsmith 7y ago
https://www.youtube.com/watch?v=coPevaETtnM https://www.youtube.com/watch?v=coPevaETtnM
sashavingardt2 7y ago
Perhaps I'm silly but wasn't it obvious that things like that would happen with Nest, Alexa and the like when devices like these first came out?
Havoc 7y ago
Reminds me of this: https://i.imgur.com/ZtacKhz.jpg https://i.imgur.com/ZtacKhz.jpg
Xyik 7y ago
Its in google / Nest's best interest to put in common place security measures like MFA or notifications like detecting an unknown device accessing the camera. If I'm paying this much $ for a product, i don't want to have to deal with having to understand the 100 different ways it could be compromised and having to deal with that.
freeflight 7y ago
Why are so many people here trying to reinvent the wheel? We already invented the wheel that fixes this particular problem, it's called 2FA. If users decide not to use it, then there's nobody to blame but them. Thinking up ever more complex schemes, to offload all the responsibility on the services, won't solve any of this. At the end of the day user error overrides it all and massive database breaches even affect those that should know how to properly secure their stuff [0]. 2FA is not perfect, it's not convenient but it's one of the last remaining effective defenses when massive breaches have become so normalized that known pwned accounts outnumber people alive on the planet [1]. [0] https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/ https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-... [1] https://haveibeenpwned.com/ https://haveibeenpwned.com/
- thorwasdfasdf 7y ago
  or how about just don't re-use passwords accross accounts. If they had used a unique password they would've been fine right? I don't understand what users want google to do: it's the house equivalent of taking your key and leaving it at the grocery store.
  - rvnx 7y ago
    It's not so sure, in some cases, passwords can be compromised by other ways directly from the source, or accesses can be derived from misimplemented APIs. No matter how big the company is, this is really realistic. Facebook, Google and others all used to leave some passwords in clear-text during very long time for anyone to check in the logs. Google even got their central password system compromised and source-code stolen (Gaia). It can also be a password recovery process that can have glitches (Steam), or just not checking password properly due to deployment errors (Dropbox) or just compromised servers (my unique EA Origin password was compromised like this, my LinkedIn password as well, my Twitter password...) etc many possibilities
    - freeflight 7y ago
      At this point, I just assume that any password I have somewhere is public in some way, if something doesn't have 2FA, it might as well be compromised. Case in point: I just checked an e-mail account I haven't used in close to 20 years, even that thing has now a somewhat lengthy haveibeenpwned profile.
miguelmota 7y ago
> In every email, they remind me of two-step authentication. They act as if I am going to continue to use Nest cameras. Well, isn't that's exactly what the customer support team is suppose to do? They'd be a terrible customer support representative if they didn't encourage good security practices and didn't try to maintain customer relationships. Not having 2FA is unacceptable in 2019. The best form of security is a combination of these 3 things: - "Something you know — Password, security questions, personal information, etc. - "Something you have" — Security key (Yubikey, Smartcard, Ledger Nano, etc.), software key (HOTP/TOTP), ̶S̶M̶S̶, email, etc. - "Something you are" — Biometrics (Touch ID, Face ID, etc.)

194 points by Balgair 7y ago

> It is not evil to bring a product to market before the privacy has been completely figured out, but it is evil to let someone threaten to kidnap an 18-month-old and have no real response. I have to disagree with the first part here. Privacy is a pretty central (and I would say _obvious_) concern, especially given the function of this particular product. I get that some people care less about privacy than others but the fact that this tech is being misused like this doesn't seem surprising to me at all.

not_a_cop75 7y ago
True. Otherwise the "Internet of Things" becomes the "Botnet of Things" as time has already shown. However, once a botnet is used for sex trafficking, it's sure to be taken much more seriously.

Cpoll 7y ago

> Essentially, an email and a password are compromised somewhere across the internet. They join millions of other email addresses and passwords, which are then cross-referenced with other websites, including Nest. This doesn't sound like a Nest vulnerability? Does Nest offer MFA?

ollie87 7y ago
Yeah, this has absolutely nothing to do with Nest and everything to do with people using the same passwords for different sites.
- toomuchtodo 7y ago
  Does Google/Nest partner with haveibeenpwned to invalidate leaked creds and force a reset by the user? Forcing MFA would also not be unreasonable considering the sensitivity of the data collected (ie video in your home), although I get this is up for vigorous debate between product, security, and engineering. Google defends Gmail users from malicious nation state actors [1]. Isn't Nest part of the Google identity ecosystem now? [1] https://security.googleblog.com/2012/06/security-warnings-for-suspected-state.html https://security.googleblog.com/2012/06/security-warnings-fo...
  - stedaniels 7y ago
    I didn't think HIBP did password hash sharing?
    - deleted 7y ago
      [deleted]
    - deleted 7y ago
      [deleted]
    - cartoonworld 7y ago
      They sure do and in fact offer an API for sites to validate sha-1 hashes against their cracked password DB[0]. The hashes are shared. Thank you to Troy Hunt [0] https://haveibeenpwned.com/API/v3#PwnedPasswords https://haveibeenpwned.com/API/v3#PwnedPasswords
      - stedaniels 7y ago
        That's not really what I was getting at. I've implemented the password lookup before. That protects users from setting passwords that have already been compromised. The scenario I was looking at was.. User signs up with Site A with Password 1. User signs up with Nest with Password 1. Site A gets compromised. Nest couldn't know if you'd used the same password on each site. The only way they could know is if they used the same hashing algo with the same salt or SHA-1 with no salt. Highly unlikely. I suppose Nest could check the Pwned Passwords API every time they logged in, but I haven't seen anyone deploy that yet, IIRC all solutions I've seen check Pwned Passwords API when the set the password. Setting a password and checking a password are often different systems.
        cartoonworld 7y ago
        you can also download the passwords
  - Ajedi32 7y ago
    Google has their own system for detecting compromised passwords: https://www.blog.google/technology/safety-security/password-checkup/ https://www.blog.google/technology/safety-security/password-... I have no idea if it's integrated with their primary login flow though. It's certainly integrated with the password manager in Chrome.
- ithinkinstereo 7y ago
  Yes, but that is a pedantic technicality that misses the point. Google markets Nest's ease-of-use and plug-and-play simplicity to non-tech users. That's a critical piece of the product's value proposition: that it just works and you don't have to think too much about it. For user security not to be a major design consideration from the onset seems extremely shortsighted... especially since this is an internet-connected camera that you're placing all over your home. Not thinking about security and privacy implications was Google's first failing. The second failing is its broken culture when it comes to customer support.
- codesushi42 7y ago
  Nope. One easy fix. Send a verification email to users when a different device is detected before allowing log in. I mean, even Steam does this.
basseq 7y ago
Yes, Nest offers MFA. You should enable it now: https://support.google.com/googlenest/answer/9295081?hl=en https://support.google.com/googlenest/answer/9295081?hl=en
sco1 7y ago
> Does Nest offer MFA? I don't remember what Nest used before being bought by Google (I believe SMS MFA was available), but they're transitioning accounts to sign in with your Google account.
- marklyon 7y ago
  But, if you transition, you lose some significant existing functionality and integration.
_iyig 7y ago
Yes, Nest has offered MFA for years. The blame for this incident falls squarely on the user, who reused the same (weak?) password across multiple websites without enabling MFA.
- lultimouomo 7y ago
  One the one hand I agree the specific issue is the user fault. On the other hand, you're selling internet controlled audio and video recorders to the general public. What did you expect?
  - _iyig 7y ago
    Every single day people crash cars, cut themselves on kitchen knives, and choose weak methods of single-factor authentication. There’s only so much the seller can do. We’ve seen how much users love (and subvert) “strong password requirements.”
NinoScript 7y ago
IMO, the device should require MFA to be configured before working, using it without one should be left at most as an “advanced setting”.
_bxg1 7y ago
Yeah, I clicked this assuming (with a bit of surprise) that Google's IoT device security is as paper-thin as all the rest, but this was 100% user error. I don't know what he expects Google to do about it.
AdamJacobMuller 7y ago
They offer MFA, only via SMS. Not perfect, but, its decent. I still use it and will continue to do so until someone releases a better ecosystem. Right now I get an alert on my phone if someone rings the bell, or leaves/removes a package. Plus with facial recognition I get alerts which include the person's name for common visitors (via facial recognition) and will announce visitors via a set of google home minis. Nest will alert my phone if the smoke detector sees smoke or CO. I'm obviously quite "all in" on their ecosystem. I also will note I have an elderly relative at home as well as 3 dogs and we are not there most days so the ability to see what's going on at home and potentially take action like calling the police/fire/EMS is extremely valuable to me.
linsomniac 7y ago
I've gone "all in" on turning on MFA, preferring TOTP when possible, over the last ~6 months. A surprising number of sites that really should do not offer any MFA. Like bank accounts, credit cards, investing accounts, payroll, cars... My money may not be safe, but at least my github commits are!
_Microft 7y ago
People reusing passwords and email adresses is a known problem and not rare at all. So deal with it, i.e. you need to make sure that your service can not be affected by a simple leak. Not doing so means putting the security of your users and their experience with your product into the hands of other people (everyone who knows the email and password combination of your user). Ideally, being susceptible to a leaked password-email-combination should be considered gross negligence.
- dwild 7y ago
  > you need to make sure that your service can not be affected by a simple leak How can you use any service then if in your mind any service should be be able to not be affected by a leak? My username/password combo is everything I need to use my account fully. Should there be another factor to use my account? I should be forced to get set another factor to post on HN? This is just absurd. We just can't keep increasing road block to let people not learn how to use something. There will always be an idiot to outsmart you.

stanski 7y ago

I wonder if Google execs are regretting the original "don't be evil" slogan yet.

me_me_me 7y ago
They dropped it long time ago.
- stanski 7y ago
  I realize they dropped it but it's not stopping everyone from referencing it every time there's negative publicity.
xiphias2 7y ago
I don't think so. When I joined Google a long time ago I really believed that they are honest. They were actually very different from other companies at that point in time. It's just harder to be not evil when margins are shrinking.
tempodox 7y ago
I wouldn't drop a slogan that forces attacks of convulsive laughter (like “don't be evil” does coming from Google). There is no such thing as bad publicity.
anigbrowl 7y ago
Why? It's not like it has guided them for a long time, but still provides a useful distraction for the naive.

_-___________-_ 7y ago

User used same credentials for multiple sites. User did not use multi-factor authentication. Another site was hacked and the credentials exposed. Someone used those credentials to log into user's Nest account and access the speaker. User is upset at Google for some reason.

bluejekyll 7y ago
Well, maybe given that this is a security product Google should require rather than just encourage MFA. In that sense Google could make the security stronger for their customers but chooses to make it easier to install and use for the majority. Getting downvoted for this, but consider this: they require a password for security purposes, why don’t they require MFA? Why is this not a requirement for this product or all their products? It’s a barrier to entry, and an eases of use thing, which means it’s a product decision to not require stronger authentication on this or all their products.
sp332 7y ago
Google needs to do incident response on this. And get law enforcement involved.
Maximus9000 7y ago
Would it be possible to do something like this: 1. user Initially creates login and password for Nest device 2. Before Nest accepts your password, it checks HaveIBeenPwned.com to see if that password has already been used before for this email address. If so, the password is rejected.
- dublinben 7y ago
  It's not only possible to do this, but should be expected for any security product. Nest is equally at fault here for allowing a user to use a known-breached password.
vezycash 7y ago
Blaming the user alone is crazy. If I login to my gmail account using a different PC, google won't let me in without sending a text to my phone or a code to my email. Sometimes, even using a different browser on the same PC I typically use triggers this security check. Even after letting me in, Gmail will send a notice of the strange login to my backup email - the mail will contain the time and ip of the event. Same with telegram. Loging to a new app/device and Telegram will sends the notification to the two apps I use on my main PC, my secondary pc, and my phones. Deleting the notification on one client app won't remove it from the rest. This way, an intruder can't erase the evidence. Also, almost almost every other email service I own badgers me to set up 2factor - either another email, a phone, back up codes or 2-factor authenticator apps. If Google/Nest isn't doing this - then, part of the blame lies with them. These basic, obvious, common sense security/password practices you know is breaking news to "NORMAL" people.

teslaberry 7y ago

What about if its a robot AGI testing humans. And what if the AGI is planning on using sentient physical robots to kidnap the baby? And WHAT IF, that robot is going to be the next robot. Solf and marketed by google amd amazon as you home security robot designed to prorotect your beby from being kidnapped. Its the robots!!!!!

nkrisc 7y ago

How could Google have prevented this except by requiring MFA? Even that isn't guaranteed to prevent 100%. I'm no Google apologist, just a pragmatist.

sp332 7y ago
It's not about the incident happening, it's about the response. If you know there are criminals on your network you should work to remove them.
jawns 7y ago
A couple things just off the top of my head ... * Detect that a login occurred from an unrecognized IP and email the account holder to tip them off. * More stringent password requirements and a check against public leaked database registries to alert the user that the password they're using has been leaked. But it seems like the bigger frustration is not that they did not prevent it, but that when it occurred it was difficult to raise the issue, and the response was tremendously inadequate.
- giarc 7y ago
  The issue with your first suggestion is the whole idea of signing into your Nest account is that you are away from home, therefore your IP would be different. Not saying they can't do it, but accessing your device from a different IP is kind of the point.
  - nicpottier 7y ago
    Sure, but then you just log into your email and click a link and then you are in. Lots of sites do this and it would prevent this kind of attack in most cases. (assuming the leaked password was not also reused in email, but then you are in for an entirely different level of hurt anyways)

whoisjuan 7y ago

Well, this is a case of stolen credentials...but the behavior behind this is just a sample of how fucked is this world. Who in their right mind enjoys distressing others in that way? I try to convince myself that there's hope for the world but when I hear about this type of things I lose that hope. There are legit evil people in this world.

dwild 7y ago
> There are legit evil people in this world. There's 8 billions people in the world. There's every kinds of them. The commons one aren't interesting, they are commons, they aren't the one that we want to talk about. Thus what you see are only the best or the worst. Please don't lose hope because of that.

jimrandomh 7y ago

A lot of comments here are blaming the user for using the same username/password on multiple sites, allowing their account to be compromised. This is missing the point. Nest cameras are a security product aimed at non-technical users, so of course this happens frequently, and of course this was foreseeable at the very earliest design stages. The designers needed to come up with a solution to this problem, and blaming the user is not an acceptable excuse. The solution is actually pretty easy: require a pairing procedure that can't be done remotely. For example, the Nest app on a phone could display a QR code with is public key fingerprint, which you show to a camera, and the camera will only send video to phones it's been paired with. That would pretty much completely eliminate this failure mode.

wrs 7y ago
So every time you add a camera, everyone in the family/workplace has to go find it and physically pair every one of their devices with it? That doesn’t sound workable.
- uhoh-itsmaciek 7y ago
  Doesn't it? Compared to the nightmare described in the article?
  - CobrastanJorji 7y ago
    I see this idea being proposed in an early design meeting. Then I see a product manager seriously consider it and then veto it. Why? Because their product's goal is to be the easiest to use camera system, and this makes using it much harder. But let's say the PM and the rest of management was convinced. So they make it require pairing and send it out for field testing. Field tests come back: "it's really annoying that I have to pair all of my phones individually with each camera." Management tells engineering to fix that. But let's say that the engineers once again convince management that this is a good idea. The product is launched. The review from CNET or Wirecutter or something comes back: "it's crazy in this day in age that I need to get a ladder and go around to all of my cameras to introduce them all to my new phones every time I do my yearly iPhone upgrade." CEO now has a crisis and demands this be fixed. Engineer pushes back again and is probably fired this time. Feature is removed. A few years later, this article comes out and it causes much, much less damage to the brand than the bad usability reviews. Everyone learns the wrong lesson.

danielovichdk 7y ago

Who would ever in their wildest dreams have devices from a huge data collections company, watching and listening in your home? It's beyond uintelligent, i you really think about it.

vezycash 7y ago
You read HN. So you're one of the few people on this planet who have even heard of the term "huge data collections company" much less have an opinion about it. In the mind of the populace, I think Google might stay in the same brain spot reserved for father christmas. I would have suggested a massive privacy awareness campaign but I doubt it'll work - especially when it comes at the cost of convenience.
deleted 7y ago
[deleted]
dylan604 7y ago
Sure, to the average HN user, if even that. As a thought experiment, you know the inner-workings of G. Take one step back, and consider if your parents have that same understanding. Sure, you may have talked about it with them at dinner once/twice/often, but do they really understand it? Now, multiply that by the greater majority of people that have no-tech understanding nor friends/family to enlighten them. To them tech might as well be magic. Everything is "push a button, get a prize" mentality for end-user tech now.
- davengh 7y ago
  Arthur C Clarke's Third Law: "Any sufficiently advanced technology is indistinguishable from magic." My in-laws are firmly in the "computers are magic" camp. Say what you like about they should learn etc, but they're in their 80s, have already lived through multiple technological revolutions, and at this point don't have the energy or interest to work through another one.
  - dwild 7y ago
    Would your in-laws would let a kid play with power tool too? They are aware that someone not able to understands the danger of power tools and how to use them safely shouldn't use them. That's nothing new. Yet they still do...

mcnichol 7y ago

Putting it on the company to stop you from not doing things that make you prone to the most common and low-barrier password stuffing attacks? People reusing passwords is risky and frankly stupid behavior. The same way you are responsible for your financial identity and can be taken to court over these disputes, you are also responsible for your cyber identity. The longer you avoid being held responsible, the worse the pain will be.

rjkennedy98 7y ago

I had the same response from Google when my mom got hacked and she paid off hackers $6000 in Google Play cards. Why does Google allow people to be scammed via their gift cards when they could easily fix this by putting in basic checks? Crickets. Its easy to say 'my mom should know better', but like most users in the world she is not technical. She grew up on a farm, how is she supposed to understand this stuff. It should be on these companies that make enormous profits to protect all users. This includes users who are not technical.

markstos 7y ago
I grew up on a farm. We lived in a barn at first. I know this stuff. I hope you helped your mom set up 2FA after that. Would basic checks would you recommend that Google on top of offering a robust 2FA solution?
- rjkennedy98 7y ago
  Here are few things they could do: * ensure that where they sell gift cards there are store limits on how many gift cards can be bought. * track the usage of the card to make it more difficult for criminals to use them. * put a day delay on the card or make the user register to make it more difficult for the user to immediately sell the card off to criminals Google is very aware that their gift cards are used in massive fraud schemes of millions of dollars that target the most vulnerable (the elderly). It is similar how there is a huge fraud scheme build on Nest products. That they allow it to happen (as it is of no cost to them) is incredibly irresponsible and in opinion even criminal. When I called Google, their response was that on the back on the cards there is warning in small print that if you give the scratch off key, the money is unrecoverable. As if someone being told that their entire life will come down crashing around them if they don't send the money is going to read the small print on a gift card! Google is probably the company in the world that is the best at tracking users and cyber security. There is no reason why they couldn't prevent these use cases if they put effort in.
driverdan 7y ago
> She grew up on a farm, how is she supposed to understand this stuff. I'm sure it wasn't your intention but that's quite insulting. Just because someone didn't grow up with technology doesn't mean they can't learn and understand it. Farmers especially since they're very DIY and resourceful.

giarc 7y ago

CanadaPost is resetting all user passwords now due to a similar breach [1]. "The cause appears to be that login and password credentials stolen in external privacy breaches unrelated to Canada Post were used to access individual Canada Post accounts. This is possible when users reuse their credentials on several websites to avoid having to remember different passwords." I'm not sure how they plan to prevent users from just reusing another password, however perhaps this education will help. 1. https://www.canadapost.ca/cpc/en/our-company/news-and-media/corporate-news/closures-and-service-interruptions-details.page?article=2019/10/16/canada_post_is_reset&cattype=announcements&cat=updates https://www.canadapost.ca/cpc/en/our-company/news-and-media/...

ficklepickle 7y ago
Canada Post doesn't sanitize user input very well. Username/password is reflected unchanged in JS. Got a console error because my password has a single quote in it.

jakobegger 7y ago

Many services send you an email when someone logs in from a new device. Does Nest not do that?

hartator 7y ago

> it was the user’s fault for using a compromised password and not implementing two-step authentication Very low technical skill for someone writing for a website called siliconvalley.com.

keiferski 7y ago

If you leave your front door unlocked and someone robs your house, is it the door manufacturer’s fault? Genuine question, it is interesting that one product has certain expectations while another doesn’t.

4ntonius8lock 7y ago
Exactly my thought. All this anger is so weird to me. I think the super angry response we are seeing is a result of the authoritarian lean of our current times. It's like the concept of freedom IMPLYING responsibility has been completely done away with. The operating concept is: adult consumers are children, and need to be protected.
lawn 7y ago
A better analogy would be buying a door that might unlock at a random time during the night, if you didn't use the right motion when you locked it.
defen 7y ago
People generally have an intuitive understanding of the security properties of doors. On the other hand, my mid-70s in-laws still have not internalized the idea that the threat model for bad / reused passwords is not "some guy sitting at a computer randomly trying passwords". A better example for the door analogy would be that you leave it unlocked so you can grab something out of the car in your driveway, and by the time you get back someone from Russia has taken all your stuff.

rezmeplease 7y ago

bruh

ben7799 7y ago

On top of having to fail password/2FA security basics for your kid to be subjected to this you have to: - Have both parents decide the child is not a high enough priority for one of them to stay home - Decide it's too much hassle to take the kid to a professional style day care where there are multiple adults watching each other to make sure none of the adults are badly behaved with the kids - Also too much of a hassle to go to a home day care where less professional adults could watch the kid, but at least there are more than one of them working there in case one of them starts to mistreat the kids - Hire a nanny, but not trust the nanny, cause sometimes nannies are badly behaved too - Decide you trust the IoT company more than the nanny or any of the above First world 1%er problem for sure.

0xfeba 7y ago
I hate to break it to you, but nannies and nest cams do not automatically place anyone in the 1%, or 10%, or 50%.

cbsmith 7y ago

https://www.youtube.com/watch?v=coPevaETtnM https://www.youtube.com/watch?v=coPevaETtnM

sashavingardt2 7y ago

Perhaps I'm silly but wasn't it obvious that things like that would happen with Nest, Alexa and the like when devices like these first came out?

Havoc 7y ago

Reminds me of this: https://i.imgur.com/ZtacKhz.jpg https://i.imgur.com/ZtacKhz.jpg

Xyik 7y ago

Its in google / Nest's best interest to put in common place security measures like MFA or notifications like detecting an unknown device accessing the camera. If I'm paying this much $ for a product, i don't want to have to deal with having to understand the 100 different ways it could be compromised and having to deal with that.

freeflight 7y ago

Why are so many people here trying to reinvent the wheel? We already invented the wheel that fixes this particular problem, it's called 2FA. If users decide not to use it, then there's nobody to blame but them. Thinking up ever more complex schemes, to offload all the responsibility on the services, won't solve any of this. At the end of the day user error overrides it all and massive database breaches even affect those that should know how to properly secure their stuff [0]. 2FA is not perfect, it's not convenient but it's one of the last remaining effective defenses when massive breaches have become so normalized that known pwned accounts outnumber people alive on the planet [1]. [0] https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/ https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-... [1] https://haveibeenpwned.com/ https://haveibeenpwned.com/

thorwasdfasdf 7y ago
or how about just don't re-use passwords accross accounts. If they had used a unique password they would've been fine right? I don't understand what users want google to do: it's the house equivalent of taking your key and leaving it at the grocery store.
- rvnx 7y ago
  It's not so sure, in some cases, passwords can be compromised by other ways directly from the source, or accesses can be derived from misimplemented APIs. No matter how big the company is, this is really realistic. Facebook, Google and others all used to leave some passwords in clear-text during very long time for anyone to check in the logs. Google even got their central password system compromised and source-code stolen (Gaia). It can also be a password recovery process that can have glitches (Steam), or just not checking password properly due to deployment errors (Dropbox) or just compromised servers (my unique EA Origin password was compromised like this, my LinkedIn password as well, my Twitter password...) etc many possibilities
  - freeflight 7y ago
    At this point, I just assume that any password I have somewhere is public in some way, if something doesn't have 2FA, it might as well be compromised. Case in point: I just checked an e-mail account I haven't used in close to 20 years, even that thing has now a somewhat lengthy haveibeenpwned profile.

miguelmota 7y ago

> In every email, they remind me of two-step authentication. They act as if I am going to continue to use Nest cameras. Well, isn't that's exactly what the customer support team is suppose to do? They'd be a terrible customer support representative if they didn't encourage good security practices and didn't try to maintain customer relationships. Not having 2FA is unacceptable in 2019. The best form of security is a combination of these 3 things: - "Something you know — Password, security questions, personal information, etc. - "Something you have" — Security key (Yubikey, Smartcard, Ledger Nano, etc.), software key (HOTP/TOTP), ̶S̶M̶S̶, email, etc. - "Something you are" — Biometrics (Touch ID, Face ID, etc.)