4 ms·

User used same credentials for multiple sites. User did not use multi-factor authentication. Another site was hacked and the credentials exposed. Someone used t

User used same credentials for multiple sites. User did not use multi-factor authentication. Another site was hacked and the credentials exposed. Someone used those credentials to log into user's Nest account and access the speaker. User is upset at Google for some reason.

bluejekyll 7y ago
Well, maybe given that this is a security product Google should require rather than just encourage MFA. In that sense Google could make the security stronger for their customers but chooses to make it easier to install and use for the majority. Getting downvoted for this, but consider this: they require a password for security purposes, why don’t they require MFA? Why is this not a requirement for this product or all their products? It’s a barrier to entry, and an eases of use thing, which means it’s a product decision to not require stronger authentication on this or all their products.
sp332 7y ago
Google needs to do incident response on this. And get law enforcement involved.
Maximus9000 7y ago
Would it be possible to do something like this: 1. user Initially creates login and password for Nest device 2. Before Nest accepts your password, it checks HaveIBeenPwned.com to see if that password has already been used before for this email address. If so, the password is rejected.
- dublinben 7y ago
  It's not only possible to do this, but should be expected for any security product. Nest is equally at fault here for allowing a user to use a known-breached password.
vezycash 7y ago
Blaming the user alone is crazy. If I login to my gmail account using a different PC, google won't let me in without sending a text to my phone or a code to my email. Sometimes, even using a different browser on the same PC I typically use triggers this security check. Even after letting me in, Gmail will send a notice of the strange login to my backup email - the mail will contain the time and ip of the event. Same with telegram. Loging to a new app/device and Telegram will sends the notification to the two apps I use on my main PC, my secondary pc, and my phones. Deleting the notification on one client app won't remove it from the rest. This way, an intruder can't erase the evidence. Also, almost almost every other email service I own badgers me to set up 2factor - either another email, a phone, back up codes or 2-factor authenticator apps. If Google/Nest isn't doing this - then, part of the blame lies with them. These basic, obvious, common sense security/password practices you know is breaking news to "NORMAL" people.
anigbrowl 7y ago
The whole reason (most) users buy security products is because they don't think like criminals in the first place.

bluejekyll 7y ago

Well, maybe given that this is a security product Google should require rather than just encourage MFA. In that sense Google could make the security stronger for their customers but chooses to make it easier to install and use for the majority. Getting downvoted for this, but consider this: they require a password for security purposes, why don’t they require MFA? Why is this not a requirement for this product or all their products? It’s a barrier to entry, and an eases of use thing, which means it’s a product decision to not require stronger authentication on this or all their products.

sp332 7y ago

Google needs to do incident response on this. And get law enforcement involved.

Maximus9000 7y ago

Would it be possible to do something like this: 1. user Initially creates login and password for Nest device 2. Before Nest accepts your password, it checks HaveIBeenPwned.com to see if that password has already been used before for this email address. If so, the password is rejected.

dublinben 7y ago
It's not only possible to do this, but should be expected for any security product. Nest is equally at fault here for allowing a user to use a known-breached password.

vezycash 7y ago

Blaming the user alone is crazy. If I login to my gmail account using a different PC, google won't let me in without sending a text to my phone or a code to my email. Sometimes, even using a different browser on the same PC I typically use triggers this security check. Even after letting me in, Gmail will send a notice of the strange login to my backup email - the mail will contain the time and ip of the event. Same with telegram. Loging to a new app/device and Telegram will sends the notification to the two apps I use on my main PC, my secondary pc, and my phones. Deleting the notification on one client app won't remove it from the rest. This way, an intruder can't erase the evidence. Also, almost almost every other email service I own badgers me to set up 2factor - either another email, a phone, back up codes or 2-factor authenticator apps. If Google/Nest isn't doing this - then, part of the blame lies with them. These basic, obvious, common sense security/password practices you know is breaking news to "NORMAL" people.

anigbrowl 7y ago

The whole reason (most) users buy security products is because they don't think like criminals in the first place.