Unfortunately the only additional authentication Nest offers is SMS base 2-step auth. You would think being owned by Google they would allow for 2FA.
Family traumatized after Nest system hacked by stranger
41–50 of 75 posts
Re: Family traumatized after Nest system hacked by stranger
#42How is poor password security "hacking"? If you choose to use the same password on all of your devices then that is solely on you.
Legally, it is hacking. I remember a story about someone getting an absurdly long prison sentence for guessing a simple password to a secure system. Hacking only specifies the knowing and intentional circumvention of an authorization system. It doesn't place a value on how easy it was to do it.
Years ago a teenager was arrested for "hacking" because he just Google'd the answers to Sarah Palin's security questions to gain access to her Yahoo account.
Re: Family traumatized after Nest system hacked by stranger
#43The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…
There was a security breach. The product was operating outside of the behavior range that the parents were told about. If I tell you that my toaster will not catch on fire and then it burns your house down while you use it as instructed, I can't argue that you "didn't understand" its behavior - sure, you didn't predict that it would self-immolate, but is it really your job to reverse-engineer my product to check for…
Your analogy implies that compromised IoT devices are some rare statistical anomaly that nobody could possibly predict ever happening.
Re: Family traumatized after Nest system hacked by stranger
#44Earlier quoted context omitted.
There was a security breach. The product was operating outside of the behavior range that the parents were told about. If I tell you that my toaster will not catch on fire and then it burns your house down while you use it as instructed, I can't argue that you "didn't understand" its behavior - sure, you didn't predict that it would self-immolate, but is it really your job to reverse-engineer my product to check for…
Being able to access the camera remotely given the correct password is absolutely within the behaviour range that users are told about. It's the entire point of the product. Do they want remote access or not? If so, then it's the user's responsibility to provision that access appropriately. Passwords and 2-factor might be too complicated for some, but what else do we have?
>We have seen instances where a small number of Nest customers have re-used passwords that were previously exposed through breaches on other websites, and made public. None of these breaches involved Nest. This exposes these customers to other people using the credentials to log into their Nest account.
Subtly, Nest did not actually claim that the attacker had a correct password. For all we know this instance was a breach.
Re: Family traumatized after Nest system hacked by stranger
#45The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…
I must have missed the part in the Nest manual where they told you to expect complete strangers to be able to watch you and speak to you through it.
It's the part that talks about how there's a camera and a speaker on an IoT device that's connected to the internet.
Seriously, though, my neighbor's entire house is wired up. His lights, his camera / security system, his shades, his music player, his TV... just about everything is integrated into Alexa. It boggles my mind why an otherwise intelligent person would do this.
Re: Family traumatized after Nest system hacked by stranger
#46The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…
Company lied to consumer that this wouldn't happen. Then it happened. And you're blaming the consumer?
Huh? Where do you see anything about Nest telling the consumer this wouldn't happen? They even encourage 2-factor in the setup process of the camera. I've never seen Nest say anywhere that the camera is 100% secure.
Re: Family traumatized after Nest system hacked by stranger
#47The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…
I must have missed the part in the Nest manual where they told you to expect complete strangers to be able to watch you and speak to you through it.
I also missed that in the Facetime manual.
Re: Family traumatized after Nest system hacked by stranger
#48Earlier quoted context omitted.
There was a security breach. The product was operating outside of the behavior range that the parents were told about. If I tell you that my toaster will not catch on fire and then it burns your house down while you use it as instructed, I can't argue that you "didn't understand" its behavior - sure, you didn't predict that it would self-immolate, but is it really your job to reverse-engineer my product to check for…
Your analogy implies that compromised IoT devices are some rare statistical anomaly that nobody could possibly predict ever happening.
Your reply implies that consumers have a deep understanding of an industry that's outside of their areas of expertise.
Re: Family traumatized after Nest system hacked by stranger
#49The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…
Company lied to consumer that this wouldn't happen. Then it happened. And you're blaming the consumer?
Really? Google promised these people that if someone else used their correct username and their correct password, that other person wouldn't be able to log into the Nest camera?
I didn't see anywhere in the article that says Google promised that, and from what I know of security that's impossible. The article did say Google offered a way of increased security, an answer the consumer neglected to use and says isn't enough. (edit - says with absolutely no knowledge on the subject that 2FA isn't enough)
In your opinion, what should Google have done differently here? And where did you see that Google promised no one would be able to log in if that person had the correct username and password and 2FA wasn't enabled?
Re: Family traumatized after Nest system hacked by stranger
#50> A Nest spokesperson responded to our request for comment and issued this statement: > "We have seen instances where a small number of Nest customers have re-used passwords that were previously exposed through breaches on other websites, and made public. None of these breaches involved Nest. It's surprising how many people reuse their password or use unsafe passwords. Including my own family.
It's frustrating, isn't it? "We" spend a lot of time warning people about the dangers of phishing and to not give away their credentials. Then they give those same credentials away to random site operators who through malice or incompetence may end up giving those credentials to bad actors. I think most people don't grok the problem. They think 'this will never happen to me' and when it happens to them, they blame someone else. Reading the article, I don't get the sense that the family in the article learned anything. They seem to still be blaming the devices.