Family traumatized after Nest system hacked by stranger • Hacker News Board

Re: Family traumatized after Nest system hacked by stranger

#31

Post by crysin » Thu, Nov 01, 2018, 3:55 PM UTC

Cynddl wrote: post #2

> Sorry, this content is not available in your region. I guess Fox 4 KC didn't want to implement the GDPR… But what happens with the GDPR if I, a European citizen in Europe, access this website (blocking EU IP addresses) using a VPN? The heuristic they use (IP address = country on which the user lives) is not a perfect method to assess whether they need to apply the GDPR regulation.

They're being considerate by using your IP. They're not a EU company. They have no obligation or requirement to respect the EU laws, so them adding that feature is them at least acknowledging the EU has regulations they do not follow. If you want to circumvent that by using a VPN and deceive their servers, go ahead. While sure, under the GDPR that would still hold them liable, they're not located in the EU and therefore have no reason to spend the extra effort to find extra ways to try and prevent you from accessing their content.

Re: Family traumatized after Nest system hacked by stranger

#32

Post by bluetidepro » Thu, Nov 01, 2018, 3:56 PM UTC

smacktoward wrote: post #24

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

I must have missed the part in the Nest manual where they told you to expect complete strangers to be able to watch you and speak to you through it.

Actually, that is in the manual. That's a feature of the product. You can watch and speak through it. Just because a stranger got your password from an unrelated security breach to Nest, doesn't make it Nest's fault. They have the tools available, and even encourage you in the setup process to setup 2-factor (I just recently set one up). Outside of that, this is user error, in my opinion. Nothing was "hacked" on Nest's end.

Re: Family traumatized after Nest system hacked by stranger

#33

Post by volfied » Thu, Nov 01, 2018, 3:56 PM UTC

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

If a company forces two factor authentication, people will go to a product without it, because it's easier. It's easier to blame the product than bad security practices because no one is getting trained on these.

I think the real solution will be for Android and iOS to eventually have 2FA so integrated that any app can use OS APIs to implement it.

Re: Family traumatized after Nest system hacked by stranger

#34

Post by volfied » Thu, Nov 01, 2018, 3:57 PM UTC

whatshisface wrote: post #21

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

There was a security breach. The product was operating outside of the behavior range that the parents were told about. If I tell you that my toaster will not catch on fire and then it burns your house down while you use it as instructed, I can't argue that you "didn't understand" its behavior - sure, you didn't predict that it would self-immolate, but is it really your job to reverse-engineer my product to check for…

It is not the toaster company's responsibility to make sure no one gets in your house and puts a fork in your toaster and leaves it running.

Re: Family traumatized after Nest system hacked by stranger

#35

Post by shawnz » Thu, Nov 01, 2018, 3:57 PM UTC

whatshisface wrote: post #21

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

There was a security breach. The product was operating outside of the behavior range that the parents were told about. If I tell you that my toaster will not catch on fire and then it burns your house down while you use it as instructed, I can't argue that you "didn't understand" its behavior - sure, you didn't predict that it would self-immolate, but is it really your job to reverse-engineer my product to check for…

Being able to access the camera remotely given the correct password is absolutely within the behaviour range that users are told about. It's the entire point of the product. Do they want remote access or not? If so, then it's the user's responsibility to provision that access appropriately. Passwords and 2-factor might be too complicated for some, but what else do we have?

Re: Family traumatized after Nest system hacked by stranger

#36

Post by dragonwriter » Thu, Nov 01, 2018, 3:58 PM UTC

Cynddl wrote: post #2

> Sorry, this content is not available in your region. I guess Fox 4 KC didn't want to implement the GDPR… But what happens with the GDPR if I, a European citizen in Europe, access this website (blocking EU IP addresses) using a VPN? The heuristic they use (IP address = country on which the user lives) is not a perfect method to assess whether they need to apply the GDPR regulation.

> But what happens with the GDPR if I, a European citizen in Europe, access this website (blocking EU IP addresses) using a VPN?

Then everyone involved (except the lawyers, who will make out quite well) can risk getting wiped out as the EU’s extraterritorial application of privacy regulation and the US’s civil and criminal laws on unauthorized access combine into a firestorm of transatlantic litigation.

Re: Family traumatized after Nest system hacked by stranger

#37

Post by kevin_b_er » Thu, Nov 01, 2018, 3:58 PM UTC

adventured wrote: post #15

Cynddl wrote: post #2

> Sorry, this content is not available in your region. I guess Fox 4 KC didn't want to implement the GDPR… But what happens with the GDPR if I, a European citizen in Europe, access this website (blocking EU IP addresses) using a VPN? The heuristic they use (IP address = country on which the user lives) is not a perfect method to assess whether they need to apply the GDPR regulation.

> But what happens with the GDPR if I, a European citizen in Europe, access this website (blocking EU IP addresses) using a VPN? WDAF Kansas City, is a Fox affiliate located out of Missouri state. GDPR is an EU regulation, not a global regulation, nor a US regulation. The EU and GDPR has no legal standing over most media companies in the US and very few US Web sites, because they do no business in the EU and are not…

Tribune Media would be subject to fines if they ever tried to do business in Europe.

Re: Family traumatized after Nest system hacked by stranger

#38

Post by idle_zealot » Thu, Nov 01, 2018, 3:59 PM UTC

whatshisface wrote: post #21

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

There was a security breach. The product was operating outside of the behavior range that the parents were told about. If I tell you that my toaster will not catch on fire and then it burns your house down while you use it as instructed, I can't argue that you "didn't understand" its behavior - sure, you didn't predict that it would self-immolate, but is it really your job to reverse-engineer my product to check for…

My understanding is that the password was compromised. It is well within expected behavior for Nest to allow someone with the right credentials to access the connected cameras etc. This isn't a matter of expecting the consumer to reverse-engineer their product and perform a security audit before allowing themselves to trust it, it's a matter of expecting the consumer to understand what credentials are.

Re: Family traumatized after Nest system hacked by stranger

#39

Post by markovbot » Thu, Nov 01, 2018, 3:59 PM UTC

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

Company lied to consumer that this wouldn't happen. Then it happened. And you're blaming the consumer?

Re: Family traumatized after Nest system hacked by stranger

#40

Post by noir_lord » Thu, Nov 01, 2018, 3:59 PM UTC

volfied wrote: post #33

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

If a company forces two factor authentication, people will go to a product without it, because it's easier. It's easier to blame the product than bad security practices because no one is getting trained on these. I think the real solution will be for Android and iOS to eventually have 2FA so integrated that any app can use OS APIs to implement it.

Authy is pretty impressive in that regard, I used it for the first time with twilio the other day and was impressed.

Not affiliated with either company.