4 ms·

My colleagues were only able to access my Ring camera because they had the relevant email address and password Come on, what lousy click bait. If you give some

by jibe 7y ago

My colleagues were only able to access my Ring camera because they had the relevant email address and password Come on, what lousy click bait. If you give someone your username and password, it isn't evidence of terrible security.

danso 7y ago
Hijacking a specific, known account is only one attack vector, and it is not the attack vector that has brought Ring's security into the news lately. Modern cloud services provide throttling and other protection from brute force attacks: > Ring hackers' software works by rapidly checking if an email address and password on the Ring web login portal works; hackers will typically use a list of already compromised combinations from other services. If someone makes too many incorrect requests to login, many online services will stop them temporarily from doing so, mark their IP address as suspicious, or present a captcha to check that the user trying to login is a human rather than an automated program. Ring appears to have minimal protections in place for this though. Motherboard deliberately entered the wrong password to our account on the login portal while connecting from the Tor anonymity network dozens of times in quick succession. At no point did Ring try to limit our login attempts or present a captcha.
millstone 7y ago
Right, that's why the rest of the sentence is "but Amazon-owned home security company Ring is not doing enough to stop hackers breaking into customer accounts"
addicted44 7y ago
You've taken that phrase completely out of context. The author is clarifying that their friends were only able to access it because the author gave them the email/password, because the author wants to illustrate what someone who did have your email/password could see. What's relevant are the sentences that come immediately after: >, but Amazon-owned home security company Ring is not doing enough to stop hackers breaking into customer accounts, and in turn, their cameras, according to multiple cybersecurity experts, people who write tools to break into accounts, and Motherboard's own analysis with a Ring camera it bought to test the company's security protections. Then the author goes through some instances and tools built to hack Ring passwords. IOW, the author isn't claiming that Ring is insecure because someone who he gave the email/password to is able to login. The author is showing the kind of information a person who has your email/password can access, and then is showing how easily it is for someone nefarious to get that information.
- tinus_hn 7y ago
  The article is just fear mongering bs, suggesting useless solutions like sms two factor authentication. The problem is with people using stupid passwords which is a problem on just about any service and has nothing to do with Ring. Yes it could be better but so could a lot of services.
  - shermozle 7y ago
    The level of security you provide should be commensurate with the risk. Perhaps you don't need 2FA and IP checking for your smartwatch but you probably need it for your x-ray machine. This is a device people are encouraged to put into their homes, with access to their most intimate moments. And sold to untrained consumers who probably won't even read any documentation you supply. And, as the article highlights, there are active attacks. Ring need to up their game.
    - caf 7y ago
      Yes, this seems like exactly the kind of service that should be checking passwords against known compromised password sets.
  - caf 7y ago
    SMS 2FA is not useless against credential stuffing which is largely what is going on here.
  - rumanator 7y ago
    > The article is just fear mongering bs, The article cites plenty of cases demonstrating how insecure the devices are. Are those cases BS? > The problem is with people using stupid passwords Your comment makes no sense at all. A flimsy lock doesn't become automatically secure if you argue that the lock owners have mishandled the key. The fact is that the system has been demonstrated that the system's security is lacking and at best is very vulnerable. The fact that all you need to penetrate their system is an email address and a password is more than enough to demonstrate the depth of the problem.
cj 7y ago
> If you give someone your username and password Most victims of data breaches are unaware that they're victims.

by jibe 7y ago

danso 7y ago

Hijacking a specific, known account is only one attack vector, and it is not the attack vector that has brought Ring's security into the news lately. Modern cloud services provide throttling and other protection from brute force attacks: > Ring hackers' software works by rapidly checking if an email address and password on the Ring web login portal works; hackers will typically use a list of already compromised combinations from other services. If someone makes too many incorrect requests to login, many online services will stop them temporarily from doing so, mark their IP address as suspicious, or present a captcha to check that the user trying to login is a human rather than an automated program. Ring appears to have minimal protections in place for this though. Motherboard deliberately entered the wrong password to our account on the login portal while connecting from the Tor anonymity network dozens of times in quick succession. At no point did Ring try to limit our login attempts or present a captcha.

millstone 7y ago

Right, that's why the rest of the sentence is "but Amazon-owned home security company Ring is not doing enough to stop hackers breaking into customer accounts"

addicted44 7y ago

You've taken that phrase completely out of context. The author is clarifying that their friends were only able to access it because the author gave them the email/password, because the author wants to illustrate what someone who did have your email/password could see. What's relevant are the sentences that come immediately after: >, but Amazon-owned home security company Ring is not doing enough to stop hackers breaking into customer accounts, and in turn, their cameras, according to multiple cybersecurity experts, people who write tools to break into accounts, and Motherboard's own analysis with a Ring camera it bought to test the company's security protections. Then the author goes through some instances and tools built to hack Ring passwords. IOW, the author isn't claiming that Ring is insecure because someone who he gave the email/password to is able to login. The author is showing the kind of information a person who has your email/password can access, and then is showing how easily it is for someone nefarious to get that information.

tinus_hn 7y ago
The article is just fear mongering bs, suggesting useless solutions like sms two factor authentication. The problem is with people using stupid passwords which is a problem on just about any service and has nothing to do with Ring. Yes it could be better but so could a lot of services.
- shermozle 7y ago
  The level of security you provide should be commensurate with the risk. Perhaps you don't need 2FA and IP checking for your smartwatch but you probably need it for your x-ray machine. This is a device people are encouraged to put into their homes, with access to their most intimate moments. And sold to untrained consumers who probably won't even read any documentation you supply. And, as the article highlights, there are active attacks. Ring need to up their game.
  - caf 7y ago
    Yes, this seems like exactly the kind of service that should be checking passwords against known compromised password sets.
- caf 7y ago
  SMS 2FA is not useless against credential stuffing which is largely what is going on here.
- rumanator 7y ago
  > The article is just fear mongering bs, The article cites plenty of cases demonstrating how insecure the devices are. Are those cases BS? > The problem is with people using stupid passwords Your comment makes no sense at all. A flimsy lock doesn't become automatically secure if you argue that the lock owners have mishandled the key. The fact is that the system has been demonstrated that the system's security is lacking and at best is very vulnerable. The fact that all you need to penetrate their system is an email address and a password is more than enough to demonstrate the depth of the problem.

cj 7y ago

> If you give someone your username and password Most victims of data breaches are unaware that they're victims.