4 ms·

Yeah, this has absolutely nothing to do with Nest and everything to do with people using the same passwords for different sites.

toomuchtodo 7y ago
Does Google/Nest partner with haveibeenpwned to invalidate leaked creds and force a reset by the user? Forcing MFA would also not be unreasonable considering the sensitivity of the data collected (ie video in your home), although I get this is up for vigorous debate between product, security, and engineering. Google defends Gmail users from malicious nation state actors [1]. Isn't Nest part of the Google identity ecosystem now? [1] https://security.googleblog.com/2012/06/security-warnings-for-suspected-state.html https://security.googleblog.com/2012/06/security-warnings-fo...
- stedaniels 7y ago
  I didn't think HIBP did password hash sharing?
  - deleted 7y ago
    [deleted]
  - deleted 7y ago
    [deleted]
  - cartoonworld 7y ago
    They sure do and in fact offer an API for sites to validate sha-1 hashes against their cracked password DB[0]. The hashes are shared. Thank you to Troy Hunt [0] https://haveibeenpwned.com/API/v3#PwnedPasswords https://haveibeenpwned.com/API/v3#PwnedPasswords
    - stedaniels 7y ago
      That's not really what I was getting at. I've implemented the password lookup before. That protects users from setting passwords that have already been compromised. The scenario I was looking at was.. User signs up with Site A with Password 1. User signs up with Nest with Password 1. Site A gets compromised. Nest couldn't know if you'd used the same password on each site. The only way they could know is if they used the same hashing algo with the same salt or SHA-1 with no salt. Highly unlikely. I suppose Nest could check the Pwned Passwords API every time they logged in, but I haven't seen anyone deploy that yet, IIRC all solutions I've seen check Pwned Passwords API when the set the password. Setting a password and checking a password are often different systems.
      - cartoonworld 7y ago
        you can also download the passwords
- Ajedi32 7y ago
  Google has their own system for detecting compromised passwords: https://www.blog.google/technology/safety-security/password-checkup/ https://www.blog.google/technology/safety-security/password-... I have no idea if it's integrated with their primary login flow though. It's certainly integrated with the password manager in Chrome.
ithinkinstereo 7y ago
Yes, but that is a pedantic technicality that misses the point. Google markets Nest's ease-of-use and plug-and-play simplicity to non-tech users. That's a critical piece of the product's value proposition: that it just works and you don't have to think too much about it. For user security not to be a major design consideration from the onset seems extremely shortsighted... especially since this is an internet-connected camera that you're placing all over your home. Not thinking about security and privacy implications was Google's first failing. The second failing is its broken culture when it comes to customer support.
codesushi42 7y ago
Nope. One easy fix. Send a verification email to users when a different device is detected before allowing log in. I mean, even Steam does this.

toomuchtodo 7y ago

Does Google/Nest partner with haveibeenpwned to invalidate leaked creds and force a reset by the user? Forcing MFA would also not be unreasonable considering the sensitivity of the data collected (ie video in your home), although I get this is up for vigorous debate between product, security, and engineering. Google defends Gmail users from malicious nation state actors [1]. Isn't Nest part of the Google identity ecosystem now? [1] https://security.googleblog.com/2012/06/security-warnings-for-suspected-state.html https://security.googleblog.com/2012/06/security-warnings-fo...

stedaniels 7y ago
I didn't think HIBP did password hash sharing?
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- cartoonworld 7y ago
  They sure do and in fact offer an API for sites to validate sha-1 hashes against their cracked password DB[0]. The hashes are shared. Thank you to Troy Hunt [0] https://haveibeenpwned.com/API/v3#PwnedPasswords https://haveibeenpwned.com/API/v3#PwnedPasswords
  - stedaniels 7y ago
    That's not really what I was getting at. I've implemented the password lookup before. That protects users from setting passwords that have already been compromised. The scenario I was looking at was.. User signs up with Site A with Password 1. User signs up with Nest with Password 1. Site A gets compromised. Nest couldn't know if you'd used the same password on each site. The only way they could know is if they used the same hashing algo with the same salt or SHA-1 with no salt. Highly unlikely. I suppose Nest could check the Pwned Passwords API every time they logged in, but I haven't seen anyone deploy that yet, IIRC all solutions I've seen check Pwned Passwords API when the set the password. Setting a password and checking a password are often different systems.
    - cartoonworld 7y ago
      you can also download the passwords
Ajedi32 7y ago
Google has their own system for detecting compromised passwords: https://www.blog.google/technology/safety-security/password-checkup/ https://www.blog.google/technology/safety-security/password-... I have no idea if it's integrated with their primary login flow though. It's certainly integrated with the password manager in Chrome.

ithinkinstereo 7y ago

Yes, but that is a pedantic technicality that misses the point. Google markets Nest's ease-of-use and plug-and-play simplicity to non-tech users. That's a critical piece of the product's value proposition: that it just works and you don't have to think too much about it. For user security not to be a major design consideration from the onset seems extremely shortsighted... especially since this is an internet-connected camera that you're placing all over your home. Not thinking about security and privacy implications was Google's first failing. The second failing is its broken culture when it comes to customer support.

codesushi42 7y ago

Nope. One easy fix. Send a verification email to users when a different device is detected before allowing log in. I mean, even Steam does this.