3 ms·
> credential stuffing happens all the time and really isn't newsworthy. If a bad thing happens all the time and people are unaware of it, calling attention to
by geofft 7y ago
> credential stuffing happens all the time and really isn't newsworthy.
If a bad thing happens all the time and people are unaware of it, calling attention to it is entirely newsworthy.
To you, as a jaded security person who understands that there are systemic risks to any network-connected service and nobody is good at defending against them, perhaps it's perfectly normal. To a customer who is making the decision between buying a network-connected doorbell for their security and buying a perfectly normal offline doorbell, the fact that credential stuffing happens all the time is a thing they need to hear about!
(Also, there are straightforward ways to resist these attacks, such as "You must use 2FA," "You can only pair a new device with your Ring account while it's in physical proximity to your Ring device," "You must use either 2FA or physical proximity," "The app will generate a password for you and won't let you use an existing one, feel free to write it down on a piece of paper," etc. A home security system should be more paranoid than a politics forum or a meme generator at keeping accounts secure.)
- dylz 7y agoI really hope physical proximity is also some kind of handshake with the device, and not spoofable in-app "GPS"
- funcDropShadow 7y agoI hope physical proximity does not mean standing in front of the door. Outside.
- jessriedel 7y agoUnder that justification, it would require at a bare minimum giving the reader the proper context, e.g., "similar non-breach threats exists for a large number of common online services, such as [list examples the reader is likely to know]".
- geofft 7y agoSure, but also, my impression is that similar threats do not exist for e.g. Google (because of heuristics on login attempts, scans on the backend for breached passwords, aggressive and un-silenceable notifications about new logins, a well-staffed security team, etc.). So an accurate statement is that most online services that do not specifically invest in account security are vulnerable. Then customers can decide whether they want an internet-connected home security system from a company that doesn't invest heavily in account security.
- jessriedel 7y agoAgreed