Family traumatized after Nest system hacked by stranger • Hacker News Board

Re: Family traumatized after Nest system hacked by stranger

#51

Post by sp332 » Thu, Nov 01, 2018, 4:09 PM UTC

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

Tech is still in wild-west mode. I can buy food and eat it without testing it for poisons first. I can put my money in a bank without doing my own routine audits of their security. Like nutritional labels on food or a "Schumer box" on a credit card app, maybe we could list some risks and mitigations that the user needs to keep in mind when using the product.

Re: Family traumatized after Nest system hacked by stranger

#52

Post by esotericn » Thu, Nov 01, 2018, 4:09 PM UTC

smacktoward wrote: post #24

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

I must have missed the part in the Nest manual where they told you to expect complete strangers to be able to watch you and speak to you through it.

A camera pointing at your face should be assumed to be turned on and recording you.

A camera pointing at your face hooked up to the Internet should be assumed to be broadcasting that information to the world.

We know this intuitively. Humans dislike eye contact from strangers because of what it implies. Cameras don't hit the same basic reflexes (likely because we've optimized them that way).

If we haven't done a good enough job of educating users on that, we need to address it. The UK Government run cybersecurity adverts occasionally. I don't think they go far enough.

I tell everyone I encounter to assume the worst case unless proven otherwise.

The purveyors of a commercial product aren't going to detail these things unless forced. See 'everything else ever' - food, drink, medicine, ...

Re: Family traumatized after Nest system hacked by stranger

#53

Post by freehunter » Thu, Nov 01, 2018, 4:09 PM UTC

hadrien01 wrote: post #30

paulcole wrote: post #11

Earlier quoted context omitted.

> I guess Fox 4 KC didn't want to implement the GDPR I think the content you're seeing, "Sorry, this content is not available in your region." is an implementation of GDPR compliance, no?

It's not an implementation of GDPR because the website doesn't have the right to exclude you from accessing the content even if you have not opted-in to trackers. It's a refusal to implement GDPR and having any business with European citizens (which for a local network affiliate is not a hard choice to make).

Refusal to do business in the EU certainly is an implementation of GDPR. The GDPR only applies to EU citizens, so not serving them means you meet all the compliance mandates.

Re: Family traumatized after Nest system hacked by stranger

#54

Post by shawnz » Thu, Nov 01, 2018, 4:12 PM UTC

whatshisface wrote: post #44

shawnz wrote: post #35

Earlier quoted context omitted.

Being able to access the camera remotely given the correct password is absolutely within the behaviour range that users are told about. It's the entire point of the product. Do they want remote access or not? If so, then it's the user's responsibility to provision that access appropriately. Passwords and 2-factor might be too complicated for some, but what else do we have?

> We have seen instances where a small number of Nest customers have re-used passwords that were previously exposed through breaches on other websites, and made public. None of these breaches involved Nest. This exposes these customers to other people using the credentials to log into their Nest account. Subtly, Nest did not actually claim that the attacker had a correct password. For all we know this instance was a…

Of course they are not going to give specific details about a particular customer's security incidents in a public statement. And of course they can not publicly claim that they've never had a security breach because it's impossible to know that for sure. I'm not sure how they could make the statement any more specific than they already have.

Re: Family traumatized after Nest system hacked by stranger

#55

Post by excalibur » Thu, Nov 01, 2018, 4:14 PM UTC

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

> I just can't comprehend simultaneously having children and not understanding technology.

Are your parents tech wizards? How about your grandparents?

Generational differences aside, pretty much everyone is clueless about some aspects of technology. You call yourself tech savvy, and I don't doubt you're correct, but I do doubt that your knowledge has no holes. Mine has plenty. And of course the general population's knowledge skews much thinner than HN readers. Many are on the Internet nearly every day of their lives, but ask them about something outside of the few select apps they use, and you're greeted with blank stares. Whether or not they have children is pretty much irrelevant. Giving birth may trigger some instinctive behaviors that come with a certain functional knowledge, but the layers in the OSI model aren't generally included.

Re: Family traumatized after Nest system hacked by stranger

#56

Post by ribosometronome » Thu, Nov 01, 2018, 4:14 PM UTC

sp332 wrote: post #51

warent wrote: post #10

The big takeaway here is that grown humans are mindlessly putting technology they don't understand in front of their children, and then they're blaming the technology for their own ignorance. Alright, maybe I'm being a little extreme or cynical, and my goal here isn't victim blaming, clearly this sort of thing should not have to be a concern for people, but still... Don't they have a duty to understand what they're e…

Tech is still in wild-west mode. I can buy food and eat it without testing it for poisons first. I can put my money in a bank without doing my own routine audits of their security. Like nutritional labels on food or a "Schumer box" on a credit card app, maybe we could list some risks and mitigations that the user needs to keep in mind when using the product.

Just because food is poison free doesn't mean it's consequence free. Most people just have a better understanding of food and it's consequences (feeding babies Burger King is a bad idea) when compared to tech and its consequences.

Re: Family traumatized after Nest system hacked by stranger

#57

Post by [deleted] » Thu, Nov 01, 2018, 4:19 PM UTC

hadrien01 wrote: post #30

paulcole wrote: post #11

Earlier quoted context omitted.

> I guess Fox 4 KC didn't want to implement the GDPR I think the content you're seeing, "Sorry, this content is not available in your region." is an implementation of GDPR compliance, no?

It's not an implementation of GDPR because the website doesn't have the right to exclude you from accessing the content even if you have not opted-in to trackers. It's a refusal to implement GDPR and having any business with European citizens (which for a local network affiliate is not a hard choice to make).

[deleted]

Re: Family traumatized after Nest system hacked by stranger

#58

Post by cgriswald » Thu, Nov 01, 2018, 4:23 PM UTC

esotericn wrote: post #52

smacktoward wrote: post #24

Earlier quoted context omitted.

I must have missed the part in the Nest manual where they told you to expect complete strangers to be able to watch you and speak to you through it.

A camera pointing at your face should be assumed to be turned on and recording you. A camera pointing at your face hooked up to the Internet should be assumed to be broadcasting that information to the world. We know this intuitively. Humans dislike eye contact from strangers because of what it implies. Cameras don't hit the same basic reflexes (likely because we've optimized them that way). If we haven't done a good…

I wonder if this is a generational thing. I'm gen x and cameras absolutely hit the 'same basic reflexes' for me. When someone has their camera/phone out I sense where it is looking at least as much as I sense where people's eyes are looking.

My millenial girlfriend, my youngest siblings and cousins, etc., don't seem to be aware; nor do they have the same ideas of rudeness/politeness with camera use that I have.

Re: Family traumatized after Nest system hacked by stranger

#59

Post by heavymark » Thu, Nov 01, 2018, 4:26 PM UTC

Doesn’t appear to have been hacked like all the hacks we hear about rather, the user probably reused their password on another service that was hacked and they didn’t change their passwords as hopefully instructed when that occurred. Enabling 2 factor would resolve this in most alll cases easily for the user. Versus the user having to use a password management app and constantly monitor their security and update accordingly. 1Password helps a lot but the average person won’t use that so it’s on companies like Apple to continue to improve their keychain software to help automate this for users and on companies like nest to push 2 factor more. But until Apple and other natively support 2 factor seamlessly it won’t gain massive traction for non tech users. So while this was the users fault technically it’s ultimately tech companies fault for not making security for users more fool proof. Though if everyone uses 2 factor hackers will probably find another way.

Re: Family traumatized after Nest system hacked by stranger

#60

Post by benwad » Thu, Nov 01, 2018, 4:31 PM UTC

chadash wrote: post #28

This story is pretty creepy, but at this point, people need to own up to the idea that weak passwords and passwords that are re-used across sites are going to be compromised at some point [1]. There's nothing Nest can really do about this, other than to mandate two-factor auth, which most people don't seem to like [2]. [1] I'm happy to see in my personal experience that even my non-technical friends are starting to u…

They could check the user's password against the HIBP database - many users aren't aware of these data breaches and this would prevent them using one of those passwords as well as making them aware of the problem.