9 ms·
Just reading these comments - is everyone OK with them sending your password to a server, but not with the lack of encryption? I would not expect my password t
by jonplackett 2y ago
Just reading these comments - is everyone OK with them sending your password to a server, but not with the lack of encryption?
I would not expect my password to be sent to the server in the first place.
- e3a8 2y agoSomewhat relevant (from 2013, Google knows every WiFi password in the world): https://www.computerworld.com/article/1496628/android-google-knows-nearly-every-wi-fi-password-in-the-world.html https://www.computerworld.com/article/1496628/android-google...
- deleted 2y ago[deleted]
- miles 2y agoHN discussion at the time (503 points, 302 comments): https://news.ycombinator.com/item?id=6379439 https://news.ycombinator.com/item?id=6379439
- lolinder 2y agoThat discussion is fascinating just for how dramatically the tone on Google has shifted in the past 11 years. Top comment is a defense of Google, top reply to them is more concerned with US laws than with Google's voluntary behavior.
- godzillabrennus 2y agoI know. It is crazy to me as well. Google went from “Do No Evil” to “Do Profit From Evil” and everyone seems okay with the transition.
- ksec 2y agoAnd this was after Steve Jobs started the war on Google and mentioned privacy as a concern during his era. It took the world 15 years and nearly 10 years after his death to understand this. I remember asking people who supported Google before or after their IPO how they make money with your Data. No one cares. I remember pushing for Firefox instead of Chrome in 2009, no one cares. Not even on HN. The sad thing is that those who stood up for privacy got bashed down for so many years and never received an apology. Those who defended Big Tech like Google is safe to use our data never apologised.
- m463 2y ago> No one cares. People do care, they are just sort of powerless to do anything. Try the following exercises: - try not to use google docs at work - try to block google sites from your phone - try to pay for things on the internet without accessing google/recaptcha/etc it is both too big and too small of a problem for most people to deal with. I know most technical people have done these sorts of things, but it is sort of like being your own sysadmin/security researcher. It's probably easier to run your own mail server in comparison.
- bcrl 2y agoI want to keep using Firefox, but the performance gap between it and Chrome keeps getting worse. My bank's online site takes upwards of 2 seconds to redraw in Firefox now when I scroll, whereas in Chrome scrolling is virtually instantaneous. Same thing with Google Streetview. PDF rendering in Firefox and Thunderbird takes upwards of 20 seconds to render the first page of common documents, while evince is a few hundred milliseconds. This is on my latop running recent Fedora. I'm still mostly using Firefox, but my patience is almost done.
- soco 2y agoI don't think it's fair to call that "performance gap", when for sure your bank never invested one second to even test, to say nothing of optimizing their site for Firefox. As for PDFs I never noticed that delay (sample size of one). Weird.
- winrid 2y agoI know you say chrome is fine but curious what CPU you have?
- bcrl 2y agoAMD Ryzen 7 7800X3D
- squarefoot 2y agoJust like they, and Microsoft, and many hardware manufacturers, also know every banking password/legal document/medical data in the world. Closed operating systems, applications, drivers, can all be used to exfiltrate data unbeknownst to users, including administrators. We're forced to give them some trust, otherwise the only choice would be to use only systems, software, hardware that is completely open down to the last bit, which sadly don't exist as a whole.
- cqqxo4zV46cp 2y agoThis sort of ideological take is lacking necessary nuance is and ultimately thought-terminating. There’s a difference between trust and concrete proof that something is happening, and there are degrees of both. Information security is somehow a justified field despite the fact that only a very small handful of shops own the full stack. It’s all about understanding and mitigating risk.
- account42 2y agoI don't disagree in principle but let's not conflate the trust required for proprietary software with the trust required for a service that is known to exfiltrate your data.
- squarefoot 2y agoI may have read too much science fiction, but the mere fact that someone has full access to all my data worries me, if not because we don't know anything about which form of government we would have in, say, 10 years, and how easily a corrupt government could force those businesses to surrender that data in order to find their "enemies". BTW, I don't live under a rock, I do online banking from the PC and have pretty much given up telling my lawyer and doctor not to use Whatsapp to send and receive sensitive documents, then keep them in their unencrypted phones, but that doesn't prevent me to be worried by how easy it has become to obtain personal data about someone for those who can.
- paulmd 2y agoGosh, if only there was a device vendor who didn’t do that, and offered the option for encrypted cloud backups and e2e encryption for all your inter-device traffic, and designed their privacy-sensitive services to work on anonymized tokens instead of device identifiers or user accounts… … but apple sells ads too therefore every option is equally bad! It’s funny to see people admit with the AI stuff that apple is getting it right, introducing privacy-protecting approaches and services, etc, yet refuse to admit that the same perspective and approaches have informed all their services for a long time. In the day to day, there is no legitimate debate that Apple Maps is vastly more privacy preserving than google maps, etc. People use some weird purity test where because App Store ads exist suddenly apple is the same as a literal adtech company.
- alemanek 2y agoIf Apple still made a router I would buy it. But they don’t… A new AirPort Extreme with an M Series I would be all over that though.
- 0xedd 2y ago[flagged]
- paulmd 2y ago> Yes, I'm sure their CSAM was trained on publicly available data. They sell broken-by-design devices with decades old kernel for an exuberant price but people still fall for the stale "sEcUrItY" marketing pitch. Talk about naive. and see, the problem is that people think this passes for a rebuttal, or even civilized discourse. You're literally the exact cliche that pops up in every discussion around privacy that I was referring to in my comment above. It truly costs you nothing to have a little bit of civility and class. Most of us are here to discuss and not to meme about “le apple CSAM”. I'm guessing that you're arguing about something that literally doesn't exist, to be honest. Endpoint CSAM scanning was never rolled out to consumer devices, it was a proposal from the EU (that popular savior!) that Apple successfully stalled and navigated until E2E was ready for rollout, upon which they said "lol no, that's stupid" and then the push fell apart. Regardless though, complying with lawful authorities inside their jurisdictions is something that every corporation is gonna have to do... even in china. If the EU makes dumb decisions, it's not exactly Apple's fault. EU sovereignty cuts both ways, sometimes you get GDPR and sometimes you get mandatory nannyware. But since it didn't pass, I don't know why you'd bring it up as even an issue, let alone as being something caused by apple? And again, to go back to the start, the fact that this vague "apple bad" argumentation is so routine and so tolerated is silly. You're mad about something that wasn't caused by apple and didn't actually happen anyway. It's vague tonal FUD and virtue-signaling to other people who are similar haters, and there's enough people who upvote/echo similar sentiments that it is self-sustaining. You can address the point without ducking out to random "but what about that one unrelated-to-apple bad-thing that almost happened that one time???" virtue-signaling points. The ever-relevant Paul Graham: https://paulgraham.com/fh.html https://paulgraham.com/fh.html
- cabirum 2y agoAsking this question since the first password manager
- figmert 2y agoPassword managers are very different. The details get encrypted using a passphrase, and only the encrypted data gets sent to the password manager. You don't have to trust the backend unless the frontend is changed to send non-encrypted data and/or your passphrase.
- SoftTalker 2y agoYou have to trust the frontend though. And where did you get that from?
- __MatrixMan__ 2y agoAnd even if you audited its code, would you re-audit it if that code changed?
- repelsteeltje 2y agoContrary to what crypto fantastics might have you believe, software eco systems are always built on trust. Audits are but a means to try champion that trust. And, indeed by no means a silver bullet at that.
- GTP 2y ago> software eco systems are always built on trust. Yes but, depending on how the ecosystem is built, the amount of trust needed can be smaller or greater. Reality isn't black or white, we also have shades and colors.
- __MatrixMan__ 2y agoOf course. I'd just rather trust many people narrowly rather than trusting a few people with everything. And the people who can push updates to password manager front ends... we're trusting them with everything. It's a situation which calls for a bit of extra diligence.
- thomastjeffery 2y agoThis article goes on about the Man In The Middle vulnerability, but doesn't bother to explain why there is a Middle to begin with, or why Amazon gets to put a Man at the End!
- treprinum 2y agoI suspect this is an internal sabotage from devs not agreeing with it - plaintext is easily observable and people can figure it out, causing a PR damage; encrypted passwords are basically untraceable.
- orf 2y agoMeanwhile, in reality, the offshore development firm being paid per line of code from Linksys farmed the work out to juniors who haven’t graduated and couldn’t care less if something is encrypted or not.
- throwawaysleep 2y agoEven if they have graduated, why would they care? I log an objection once at work. I've covered my butt. After that point, the outcomes are not my problem. It is less work to do it this way.
- jagger27 2y agoSure, log your objection between the choice of Tailwind and Bootstrap. In professions more serious than software, people generally use their spines and say "no" when they see problems to the degree of passwords sent in the clear.
- autoexec 2y ago> causing a PR damage The most you can expect from PR damage like this is that maybe an update goes out faster that fixes the problem (or at least hides it better). Nobody is afraid of bad PR. The most hated companies in the US are also massively wealthy and successful. If people refused to by routers from companies that pulled shit like this, nobody could buy a router. You can enter pretty much any major brand of wireless router into google next to words like "hardcoded" "backdoor" and "plaintext" and get results going back decades.
- JumpCrisscross 2y ago> most you can expect from PR damage like this is that maybe an update goes out faster Next step is trawling procurement records for public purchasers of their products, and prompting their return.
- rolph 2y agoan hypothetically interesting wifi situation SSID = [google] agrees to the following ToS. psword = use of this password confers in perpetuity, unlimited use of any and all google products and services with no cost or liability, as the owner of the password sees fit
- autoexec 2y agoNot me. I'm not even okay with being expected to use a cell phone app to configure the router.
- xp84 2y agothat's definitely the worst thing. There's nothing like being on my computer doing something, thinking "oh let me go update a setting or check some status on my router" then remembering "oh that's right, I bought Eero, let me go try to use the crappy iPhone app where I can't even multitask, instead of the full computer right in front of me."
- JohnFen 2y agoI'm certainly not OK with that. I'm not OK with a router sending anything whatsoever off to a mystery server somewhere (sending data somewhere when the user overtly sets it up to do so is OK), and any router that does that is not fit for purpose in my view. That said, I haven't considered Linksys routers to be fit for purpose at all for years now anyway.
- godelski 2y agoWait till you find out what TVs do... Which is far from ok
- 14 2y agoWhat does my smart tv that has never been connected to wifi do?
- godelski 2y agoRumor has it that some devices will connect to other networks. I'm not sure this has been proven but it seems a bit hard to catch and it seems like a thing that could be done in the name of accessibility. I'd be interested if anyone has dumped firmware and looked to see if it does or doesn't happen. Either way, not connecting your TV to wifi isn't an excuse for the behavior. Good for you, but that doesn't justify their actions or make anybody who is not up to date with what kind of spying happens any less of a victim. It shouldn't happen even if you are able to get around them. You should be able to use wifi AND not be spied on. Full stop. https://web.archive.org/web/20210912135232/https://forum.developer.samsung.com/t/if-you-choose-to-not-connect-your-samsung-smart-tv-to-wifi-it-will-secretly-connect-to-your-neighbours-passwordless-wifi/7926 https://web.archive.org/web/20210912135232/https://forum.dev...
- somat 2y agoI have seen it. I like to run an open wifi AP. The way I have it set up it sort of sucks, throttled about as low as I can get it, you could read HN on it but most websites are very unpleasant to use. Anyway, the point is, for the most part my only customer is my neighbors samsung tv sending some sort of click and navigation updates back to the mothership. Now I don't "know" that it wasn't attached to intentionally. but I suspect the tv was just happy to attach to anything it could find.
- nerdjon 2y agoThis is a big reason I despise the fact that so many ISP's just bundle routers into their modems. At least with Comcast it seems like they have the ability to modify and (I assume) see this stuff in plain text. Who thought that was acceptable from a security standpoint I will never understand.
- sneak 2y agoThere’s no useful attack that can be waged against your devices with knowledge of your wifi password. The idea that your LAN is a security boundary is out of date by decades.
- rightbyte 2y agoYou should be able to figure out how many users are connected, i.e. if you are at home.
- namaria 2y agoThird party activity on your LAN is a legal liability.
- account42 2y ago> There’s no useful attack that can be waged against your devices with knowledge of your wifi password. Famous last words. > The idea that your LAN is a security boundary is out of date by decades. I'm sure there are plenty of device and software vendors that haven't gotten the news. And exploits exist - no reason to carelessly discard a defensive layer just because it isn't 100% perfect.
- rkagerer 2y agoAndroid needs a "Backup My Data to My Own Cloud/Device" option. Unfortunately that's gotten much harder to do over the years (as they've neutered the relevant API's).
- xp84 2y agoYeah. tbh we are lucky on the Apple side that itunes existed and had a backup facility (Presumably because WAN speeds were so slow for many people in 2007). You can bet if the iOS platform were created today, local backup would have never been a thing there either. "Just trust the cloud!"
- e44858 2y agohttps://github.com/seedvault-app/seedvault https://github.com/seedvault-app/seedvault It's included in GrapheneOS, so you can backup things like WiFi passwords to a local NextCloud server.
- rkagerer 2y agoSeedvault has limitations, and last I heard GrapheneOS is trying to divorce itself of it.
- spr-alex 2y agoThis exactly. Eeros, Nest/Google Wifi, and other cloud based mesh devices all likely have access to the password as they send it down to the app. I work on SPR @ https://www.supernetworks.org/,w https://www.supernetworks.org/,w e keep data self hosted, instead of a database in someone else's cloud.
- datahack 2y agoNo, and all it does is prove, once again, that big tech companies cannot be trusted to sustain even common sense privacy concerns. We need a privacy bill of rights. It’s time! The GDPR shows the way, and we can even improve on it with hindsight. We’ll never get ahead of the data harvesting and exploitation of that data without it and all of this becomes quite an acute problem when we add low cost cognitive digital intelligences to the equation.
- rustcleaner 2y ago>Just reading these comments - is everyone OK with them sending your password to a server, but not with the lack of encryption? Take a poll and see how many iPhone users are here. Now realize the remainder are on some OEM Android! 50/50 I am the only one to reply to you running GrapheneOS. People WANT it to be this way, because any other way is too much work. It's how oligarchy arises! I am not being hyperbolic, y'alls bitlocker codes are going to Microsoft soon if not already with 24H2. Being into technology on a tech hacking [orange] subreddit does not put one into the same group as the tradecraft-savvy.
- hulitu 2y agoOf course. As long as they are not _Chinese_ servers. You see, US is our friend. /s