10 ms·
A lot of comments here are blaming the user for using the same username/password on multiple sites, allowing their account to be compromised. This is missing th
by jimrandomh 7y ago
A lot of comments here are blaming the user for using the same username/password on multiple sites, allowing their account to be compromised. This is missing the point.
Nest cameras are a security product aimed at non-technical users, so of course this happens frequently, and of course this was foreseeable at the very earliest design stages. The designers needed to come up with a solution to this problem, and blaming the user is not an acceptable excuse.
The solution is actually pretty easy: require a pairing procedure that can't be done remotely. For example, the Nest app on a phone could display a QR code with is public key fingerprint, which you show to a camera, and the camera will only send video to phones it's been paired with. That would pretty much completely eliminate this failure mode.
- wrs 7y agoSo every time you add a camera, everyone in the family/workplace has to go find it and physically pair every one of their devices with it? That doesn’t sound workable.
- uhoh-itsmaciek 7y agoDoesn't it? Compared to the nightmare described in the article?
- CobrastanJorji 7y agoI see this idea being proposed in an early design meeting. Then I see a product manager seriously consider it and then veto it. Why? Because their product's goal is to be the easiest to use camera system, and this makes using it much harder. But let's say the PM and the rest of management was convinced. So they make it require pairing and send it out for field testing. Field tests come back: "it's really annoying that I have to pair all of my phones individually with each camera." Management tells engineering to fix that. But let's say that the engineers once again convince management that this is a good idea. The product is launched. The review from CNET or Wirecutter or something comes back: "it's crazy in this day in age that I need to get a ladder and go around to all of my cameras to introduce them all to my new phones every time I do my yearly iPhone upgrade." CEO now has a crisis and demands this be fixed. Engineer pushes back again and is probably fired this time. Feature is removed. A few years later, this article comes out and it causes much, much less damage to the brand than the bad usability reviews. Everyone learns the wrong lesson.
- Udik 7y agoBut why individually? Can't all the cameras in the local network share a single pairing code?
- pbhjpbhj 7y agoOr they pair with a "controller" device and any user pairs direct with that? Could be a dongle with a button that plugs in to a router usb port.
- semi-extrinsic 7y agoFWIW, this is what Ikea's system does, and all that lets you do is turn the lights on and off.
- TeMPOraL 7y agoAlso: pair the cameras with the hub before installation, so you don't need a ladder later on.
- uhoh-itsmaciek 7y agoI don't think the answer is to throw up our hands and say, "oh well, I guess security is fundamentally incompatible with usability in consumer electronics; caveat emptor is the best we can do." I concede there's a tension between security and usability (and that compromising on usability to achieve security makes your product less appealing), but we should demand that companies find better ways to design around that tension, instead of making the bare minimum concessions to security and adopting a "blame the user" mentality.
- madhadron 7y agoOr you do something sensible like have a hub. Every client device pairs with the hub. Every sensor device pairs with the hub. The hub brokers rendezvous and authentication. And to pair anything with the hub you have to be sitting there next to it with physical access.
- Shivetya 7y agoI would expect it being even simpler, once you are paired to the network of connected devices you are connected to any future devices added to the same. next time your app connects it simply indicates a new device has been added and asks if you accept it.
- TeMPOraL 7y agoThose are equivalent, in the sense that the hub is a router to the IoT network. This functionality could be implemented on an Internet router itself, but it isn't, and honestly I wouldn't trust any consumer-grade router with it.
- derision 7y agoSounds perfectly sensible to me. If I'm setting up security cameras in my own home then requiring physical interaction with the device to pair sounds like a great idea
- markstos 7y agoOne reason to have a camera would be to provide access to a parent or family member who is far away, perhaps even in another country.
- shoes_for_thee 7y agoAnd now that far-away person will have to ask someone with actual physical access to the device send a screenshot of a QR code. This is fine. ¯\_(ツ)_/¯
- mnem 7y agoYou only really need 1 person to physically pair, and then they can authenticate other people wanting to share it.
- llamataboot 7y agoI mean, how often are you adding cameras? I have to push a physical button to control my Hue lights, and we can't require physical access to a /camera/ ?
- ocdtrekkie 7y agoPerhaps something like Keybase's solution is workable? Where you generally need to access one of your existing Keybase clients to authorize a new Keybase client. Presumably you'd add cameras and the like the same way. https://keybase.io/blog/keybase-new-key-model https://keybase.io/blog/keybase-new-key-model
- TeMPOraL 7y agoPair them with a hub. Cameras should talk to the hub on LAN, not the Internet. You can everyone's devices with the hub once. As explained in parallel, QR codes and distance are not mutually exclusive.
- flr03 7y agoI agree. Manufacturers want people to believe that their products are as safe as possible, we tech users know what it takes. The fact that "normal" users are unaware of the risks and not guided into securing their system is onto the manufacturer.
- TeMPOraL 7y agoMost manufacturers don't care, because they know that a) users aren't able to tell what's secure, and b) they face zero consequences. As a tech user, I know that if an IoT device routes data through vendor's cloud, it's unsafe, period. As evidenced by breach after breach after breach after breach.
- freeflight 7y agoHow about us tech users, that "know what it takes" do actually communicate that it takes something like 2FA to properly secure an account? Instead, we are here looking for ways how Google could fix people's tendency to opt-out of additional security. Because contrary to your claim, most bigger online services these days absolutely do guide and nudge their users into setting up 2FA, because adding a legit phone number to an account makes that account data that much more valuable for selling ads [0]. [0] https://techcrunch.com/2019/10/08/twitter-admits-it-used-two-factor-phone-numbers-and-emails-for-targeted-advertising/ https://techcrunch.com/2019/10/08/twitter-admits-it-used-two...
- pat2man 7y agoSort of like the HomeKit pairing requirements...
- gduffy 7y agoFormer co-founder & CEO of Dropcam (Nest cam) here. There's no way to say this humbly, but imo stuff like this is the reason that companies lose their way when they lose an empowered "buck stops here" product-oriented CEO with enough engineering chops to modulate product decisions. I had an endless to-do list of improvements, including security enhancements like the one you suggest (but done in a way that would not impair usability, like anything with QR codes :-)). The problem is, a string of well-meaning but amazingly risk-averse managers came in and killed the soul of the company by introducing enough bureaucracy that the team and I no longer cared to bang our heads against brick walls anymore. If the leadership doesn't a) understand product, b) understand business, c) know/respect good engineering, or d) have "fuck you, we're doing this" authority ... it will fail in spectacular ways through a series of seemingly good short-term decisions, it's just a matter of time. Combine product, business, engineering, and authority to lead, sprinkle in some ethics and respect for your customers/employees, and baby you've got a stew going. This whole privacy mess in home & so-called "IoT" is a result of people who don't even know what would be required to operate ethically with such powerful technology in the first place. I believe they are mostly good people, they just don't have the mindset or philosophy to know what to do. It kinda makes me misty-eyed. They know where to find me if it sounds like some of this could help... I'd be happy to try and get the band back together again.
- dbpatterson 7y agoThe fact that this was on your list of "improvements" rather than being a minimal requirement before being willing to launch, sell, etc, is pretty damning on it's own. No need to get misty-eyed.
- gduffy 7y agoSorry, but that shows a fundamental misunderstanding of the problem space. We entered the "IP camera" market in 2010, when all the competitor products booted a 7-year old Linux kernel with busybox and UPnP'd a port to the public internet. Admin/admin, no string escaping, buffer overflows, inadvertently indexable by Google, rooted and/or turned into botnets. Dropcam v1.0 eliminated all of those security problems. The only gotcha is that we required cloud storage. However, my plan for v2.0 Dropcam was to go with open-source verified builds + kill the cloud-storage requirement (but offer it optionally with e2e crypto). If I had required that at v1, the company wouldn't exist today, and worse stuff would have taken its place. Good product engineering requires prioritization and stepwise problem-solving, not ivory tower ethics.
- jb775 7y agoI wouldn't say their response "misses the point", I'd say it's a lazy response and they don't care (or have enough financial motivation) to dive deeper into the underlying cause of the problem. I really like your idea of a physical pairing procedure. It's not a large price to pay for dramatically increased privacy. Some other possible partial-solutions I initially thought of: 1.) Don't allow users to create their own password. Generate a strong password for them, and only show it to them once upon password creation/change. (like how API secret keys are often only displayed once upon creation) --- this would eliminate the "same password on multiple sites" issue 2.) Require a device whitelist where some type of fingerprinting/calibrating is done upon initial login by each device added to the list. 3.) Geofence logins to a pre-specified radius surrounding the camera location. E.g. if the parents work < 10 miles from home, they can set up a radius of 10 miles and understand that if they travel further than 10 miles away from home they won't be allowed access. --- this would be hackable, but would at least add another layer of protection.
- burnte 7y ago> A lot of comments here are blaming the user for using the same username/password on multiple sites, allowing their account to be compromised. This is missing the point. I disagree. This is the equivalent of blaming car manufacturers in the 70s for stolen cars when people left the keys in the cars. This is 2019. We've had PINs and passwords for decades. At some point people have to take responsibility for their own lives, their own property, and their own safety and take some things seriously. Nest and other companies can only do so much when the users keep doing stupid things like "password" for their password. If you leave your front door unlocked when you go on vacation, yes, the crook should be jailed, but you should lock the darn door.
- rhacker 7y agoI have a lot of junk sites I log into that have a REALLY shitty password - it's not tied to my credit cards or any personal info, but it was just to get something working/going. It's not the same as leaving your keys in the personal car and more equivalent to the leaving the keys in the golf cart I rented at the golf resort. Sure there's still some negative consequences of that, but if the golf staff just tell everyone to leave their keys out in the open when they're done renting, then that's what people do. All of the "2000 era china cams" (foscam or whatever) I bought had a username password that only mattered if you were on a local network. I can imagine Nest users would probably assume that's what they were doing.
- burnte 7y ago1. Your examples aren't on the same level as Nest, and I do the same thing. If you happen to hack my account at some random forum so I could see someone's attachment, have at it. 2. If anyone was so dumb as to think a camera they can view on their phone while at work or on a cruise ship was "only on their local LAN" then, again, it's 2019 and there's no excuse for that. If you can't figure out that you're seeing your house from 2,000 miles away because it's connected to the internet, I don't feel bad for you.
- Waterluvian 7y agoI don't disagree fully. I'm all for personal responsibility. But it's largely a failure of the technology of passwords. You want me to remember 30 different passwords. That's a non start. So put all my eggs into a password manager basket. But I've been scared off those because I read that some are crap or Chinese or other scary things. And it fundamentally feels insane to give everything to one app on my phone. You haven't convinced this old bag of coal that's a good idea to do. So now I'm backed into what I perceive as a "smug young tech people corner" where I feel damned no matter what I do because clearly I need to be tech savvy but you insist I don't need to be, that this is just a baseline intelligence kind of problem. That whole story is a complete failure of technology, not the user.
- freeflight 7y ago> A lot of comments here are blaming the user for using the same username/password on multiple sites, allowing their account to be compromised. This is missing the point. Omitting the lack of 2FA is missing an even more important point because it's cases like this why 2FA is pretty much mandatory today. But instead of using already available solutions, you want to reinvent the wheel with "a pairing procedure". Gee, that sounds awfully familiar to what 2FA does, which also would have completely eliminated this failure mode, if the user would have bothered to actually use it. In that context, I really don't see what Google could do differently with Nest. If users don't use additional security, then you can add all the additional security you want.
- mastre_ 7y ago> The solution is actually pretty easy: require a pairing procedure that can't be done remotely. For example, the Nest app on a phone could display a QR code with is public key fingerprint, which you show to a camera, and the camera will only send video to phones it's been paired with. That would pretty much completely eliminate this failure mode. This is how Tesla pairs a new phone to work as a key -- you need to have one of the two RFID key cards that come with the car present, and be inside the car with the new phone. You pair _that particular device_ and then authorize it with the RFID card. Simply having the login to the app/account is not enough, and from the car itself you can always remove a paired phone. A key for a car frames the problem in much clearer terms and Tesla engineered a secure solution. It is unfortunate this isn't done for other things where security is equally important.
- hinkley 7y agoIt never ceased to amaze me that the Blizzard game I used to play had better security than my brokerage. We just aren't trying that hard.