5 ms·
"When I say backdoor, what am I referring to? Sure, Eight Sleep needs a way to push updates, provide service, and offer support. That’s expected. What goes too
by nadis 2y ago
"When I say backdoor, what am I referring to? Sure, Eight Sleep needs a way to push updates, provide service, and offer support. That’s expected.
What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process.
And yes, I found evidence that this is exactly what’s happening."
^ wow, this is pretty wild. <insert joke about being careful about who you share a bed with>
- HNdev1995 2y agoI agree with you but please explain how this is any different than when an app on your phone gets updated
- physicles 2y agoIt’s completely different. Could a rogue engineer inject whatever code they want into an app update? Possibly yes, but 1) that code will get shipped to every phone at the same time, 2) that code has to do its thing without anyone noticing, which is tricky at scale (this is how malware gets discovered), and 3) there’s an audit trail so that engineer will be exposed to legal risk. The difference here is that with Eight Sleep, an engineer can remotely access the customer device in real time and poke around the network the bed is connected to, and there may be no audit logs. They can exfiltrate sensitive data with much less effort and less legal risk than with an app update.
- SeanAnderson 2y agoSounds like a good way to get bed bugs. .. I'll see myself out.
- Linkd 2y agoeven more so combined with the fact that these are supposedly being sent into the government.
- fra 2y agoYou’d be surprised at how many hardware companies think this is a good idea! I’m the founder and CEO of a company called Memfault, we make observability SaaS for hardware companies. I constantly get asked if we could just offer a remote access solution. Many of our competitors do! But we think it’s (a) a huge security liability and (b) too ripe for abuse. But fundamentally consumers do not care, and until that changes you can expect any embedded Linux device to have this kind of backdoor (they do more often than not).
- jmholla 2y agoI know it's hard, but keep fighting the good fight. I have huge respect for companies that stand by their principles harder than their revenue.
- goalieca 2y ago> What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process. More companies do this than not.