3 ms·

> The article is just fear mongering bs, The article cites plenty of cases demonstrating how insecure the devices are. Are those cases BS? > The problem is wi

> The article is just fear mongering bs, The article cites plenty of cases demonstrating how insecure the devices are. Are those cases BS? > The problem is with people using stupid passwords Your comment makes no sense at all. A flimsy lock doesn't become automatically secure if you argue that the lock owners have mishandled the key. The fact is that the system has been demonstrated that the system's security is lacking and at best is very vulnerable. The fact that all you need to penetrate their system is an email address and a password is more than enough to demonstrate the depth of the problem.

SahAssar 7y ago
> The fact that all you need to penetrate their system is an email address and a password is more than enough to demonstrate the depth of the problem. You do realize that is true for the default account for 99.9% of all web services? They do support basic 2fa (SMS based), which is not the best (Webauthn would be a lot better), but one of the biggest complaints in the article is easy brute-forcing, and they support fixing that. Some of what they suggest is even downright wrong and bad practice (like blocking certain user-agent headers). The only legitimate feature they suggest that I could see is rate-limiting based on IP, but even that is not always a good idea (since you never know how many legitimate users share an IP). Perhaps a better title would be "Ring does not do enough to advise their users on how to secure their accounts". The actual content is FUD and I'd bet that basically every VMS with a web API would have the same "vulnerabilities" in a default setup. Source: Having worked on security for similar systems.