3 ms·

One of the dumbest things I see is the idea that adding security can't be done for consumer items, as it will make it too hard for the consumer. Case in point,

One of the dumbest things I see is the idea that adding security can't be done for consumer items, as it will make it too hard for the consumer. Case in point, HP home printers that have for years (and still?) have an integrated web interface with no password by default. You can hit up one of the nicer home office printers and read or modify someone's contact list. For example, if they do a "Scan document and send to contact "Accountant", you very well may have modified it to be your email or phone. Or ask them to scan whatever's on the scanner bed. Guarunteed some of them will have some drivers license, legal document, etc. left on them. Or just pump a ton of printouts of 99% gray sheets to them for a "denial of paper and ink" attack. There are so many of them on Shodan it's not funny. I suppose the designers thought that it would be too much pain for users if this wasn't allowed. Or they didn't even think of it as an issue. The thing is it's just trivial to say have it so the first time you connect to the server, it makes you set a password. And you limit it to just the local network for connections by default.

ipaddr 5y ago
It sounds like a low risk. How many people would go through the trouble of trying to create a denial of ink and paper attack? How many people would notice? If you are trying to get your ex back perhaps these small victories help but to go on shoden to find these printers and use more color is a weird thing to do over spying on cams.
- deleted 5y ago
  [deleted]
- dumpsterdiver 5y ago
  Well, let's not disregard the more serious attack that the parent poster mentioned: > For example, if they do a "Scan document and send to contact "Accountant", you very well may have modified it to be your email or phone. In places where personnel PII is closely guarded this would absolutely be a big deal. Also, I wouldn't be so quick to dismiss the impact of a denial of ink attack at larger scales. In my experience, printers spewing gibberish isn't usually intentional, but a side effect of an improperly configured scan. Not only can this be costly in ink alone, but also in time and the patience of your employees. You've assumed that the attack is targeting the more expensive color ink, but what happens when employees can't print simple documents in black ink? Just change the cartridge (on hundreds of printers), right? And when it happens again tomorrow? After a few days you're going to have to start thinking about the wages you pay these folks to do that.
  - pugworthy 5y ago
    Pro tip: print all in grey as it's "not black" and uses all the color ink.

ipaddr 5y ago

It sounds like a low risk. How many people would go through the trouble of trying to create a denial of ink and paper attack? How many people would notice? If you are trying to get your ex back perhaps these small victories help but to go on shoden to find these printers and use more color is a weird thing to do over spying on cams.

deleted 5y ago
[deleted]
dumpsterdiver 5y ago
Well, let's not disregard the more serious attack that the parent poster mentioned: > For example, if they do a "Scan document and send to contact "Accountant", you very well may have modified it to be your email or phone. In places where personnel PII is closely guarded this would absolutely be a big deal. Also, I wouldn't be so quick to dismiss the impact of a denial of ink attack at larger scales. In my experience, printers spewing gibberish isn't usually intentional, but a side effect of an improperly configured scan. Not only can this be costly in ink alone, but also in time and the patience of your employees. You've assumed that the attack is targeting the more expensive color ink, but what happens when employees can't print simple documents in black ink? Just change the cartridge (on hundreds of printers), right? And when it happens again tomorrow? After a few days you're going to have to start thinking about the wages you pay these folks to do that.
- pugworthy 5y ago
  Pro tip: print all in grey as it's "not black" and uses all the color ink.