Ring fired employees for watching customer videos • Hacker News Board

Re: Ring fired employees for watching customer videos

#101

Post by ocdtrekkie » Thu, Jan 09, 2020, 7:47 PM UTC

tensor wrote: post #81

bshacklett wrote: post #27

Earlier quoted context omitted.

Encryption with customer managed keys solves that pretty easily. It also solves any ethical questions with regards to furnishing data to comply with warrants. This creates a new problem of managing keys, of course, but that's been solved many times now in other parts of the industry.

There are numerous logistic issues with this approach. How would you implement a feature where users could log in to view the footage while away from home? They would need the decryption key, and if the server doesn't have it how would they get it? The only secure option is from the device itself, which is a pretty big UX challenge. However, worse, features that use AI to detect movement/people/etc can't be implement…

Keybase seems to have a pretty good strategy for passing encryption keys between devices without Keybase itself having access to the keys. (I feel like this would be a great market for them to insert themselves into, possibly licensing their platform to IoT vendors.)

But yeah, I imagine you'd have a passphrase/key that can be found on a new device, perhaps via a QR code, and then signing into a new client device would require you have access to the old device to approve it/allow the private keys to transfer between the two, etc.

Re: Ring fired employees for watching customer videos

#102

Post by hinkley » Thu, Jan 09, 2020, 7:48 PM UTC

michaelmrose wrote: post #83

TeMPOraL wrote: post #53

Earlier quoted context omitted.

That's absolutely not true. Most doors are trivial to pick and as easy to break down. The main, and usually only, real reason for the lock on the door is to serve as a physical symbol which establishes a particular legal status of the property behind the doors, with associated consequences for unlawful entry. The legal apparatus - penalties, punishments - is what deters crime. Lock is an XML tag made of matter. (The…

Forget the analogies having to explicitly misuse the system to violate customers privacy creates a strong disincentive. All accesses to customers data should require multiple people not by policy but by mandatory access controls. The fact that employees could hack their employer is true and not meaningful. The number willing to commit felonies is less than the number willing to risk termination.

I feel like I asked this before and then didn't bookmark the answers.

What systems are out there for requiring consensus for access? I know about K of N protocols for hardware cryptography, but I'm fuzzy on such systems for, say, admin functionality or data retrieval. Are they all in-house at this point?

I've found over and over again in my work that it's much easier to spout rhetoric about process change when I have provided tools to facilitate those changes. Maybe it's time for us to collaborate on some tooling in this space.

Re: Ring fired employees for watching customer videos

#103

Post by nabnob » Thu, Jan 09, 2020, 7:51 PM UTC

dmitrygr wrote: post #92

How is this even possible? I know that at Google, there was no way to access customer data directly. So this couldn't happen. That seems like a saner design

Same is also true at Amazon (at least from what I can remember).

Re: Ring fired employees for watching customer videos

#104

Post by doc_gunthrop » Thu, Jan 09, 2020, 7:57 PM UTC

It seems odd to automatically trust some surveillance equipment company to not spy on your video footage when they have that access. Not to say that these companies are all untrustworthy, but rather that it would be imprudent to assume trustworthiness by default.

There are other solutions out there, like using a Raspberry Pi Zero [1] with some OSS[2]. The caveat here is that it requires a greater time investment from the consumer.

1: https://www.raspberrypi-spy.co.uk/2017/04/raspberry-pi-zero-... 2: https://github.com/ccrisan/motioneyeos/wiki

Re: Ring fired employees for watching customer videos

#105

Post by ogre_codes » Thu, Jan 09, 2020, 7:59 PM UTC

My big problem with IoT devices is trust. When a third party has control of my data, I have to trust the company is going be a responsible steward for my data. This is particularly telling since few of them (none?) have binding terms of service which protect the rights of the buyer. So you have situations like this where abuse happens or companies like Canary which made a rather big and infuriating change to their policies on storing data. To make things more complicated, if it's a small company you have to worry about it getting acquired. I've had multiple occasions where products I've purchased have shifted from having decent terms to terms which make me want to toss the product in the trash.

As a result, I'm extremely cautious about purchasing IoT products. I haven't given up smart devices entirely, but I avoid the ones that require an account to sign in or rely heavily on cloud services. Smart cameras are particularly tricky since they reveal so much about you, particularly combined with machine learning and face identification.

Re: Ring fired employees for watching customer videos

#106

Post by lmilcin » Thu, Jan 09, 2020, 8:02 PM UTC

coralreef wrote: post #22

izacus wrote: post #15

Earlier quoted context omitted.

These kind of scenarios can happen with workers in government offices, archives and medical institutions as well. And yet the paper documents are not E2E encrypted. Maybe... just maybe... technology is not really what should be the core issue here? But we should perhaps look at our policies and legislation? Adding proper liability there will make technology come by itself. The magic of free market doesn't seem to be…

The easiest way to keep someone out is to lock the door. You can create penalties, punishments, hire security guards to watch the door. But the most efficient and effective way is just a lock.

Actually, the best way to keep people out is to convince them it is not worth it to try to get in.

Re: Ring fired employees for watching customer videos

#107

Post by sp332 » Thu, Jan 09, 2020, 8:05 PM UTC

sidlls wrote: post #13

jayd16 wrote: post #12

Earlier quoted context omitted.

For scenario 1. the employee would still have access they just wouldn't be using it.

Why would that be the case? It's trivial to separate identification from content.

I guess the employee could send the video anywhere, including to themselves.

Re: Ring fired employees for watching customer videos

#108

Post by aratakareigen » Thu, Jan 09, 2020, 8:06 PM UTC

jerf wrote: post #90

tensor wrote: post #81

Earlier quoted context omitted.

There are numerous logistic issues with this approach. How would you implement a feature where users could log in to view the footage while away from home? They would need the decryption key, and if the server doesn't have it how would they get it? The only secure option is from the device itself, which is a pretty big UX challenge. However, worse, features that use AI to detect movement/people/etc can't be implement…

"How would you implement a feature where users could log in to view the footage while away from home?" The "decryption key" can be a password-like object rather than an AES key, though that does require some security, and browsers are, if not quite ready to decrypt a stream and then render it as a video file, getting pretty close to that. However, any client provided to the user by the video company itself, web or ap…

The market can be easily scared by the thought of random employees spying on them. I'd easily pay $50 for that peace of mind.

Re: Ring fired employees for watching customer videos

#109

Post by mv4 » Thu, Jan 09, 2020, 8:07 PM UTC

ogre_codes wrote: post #105

My big problem with IoT devices is trust. When a third party has control of my data, I have to trust the company is going be a responsible steward for my data. This is particularly telling since few of them (none?) have binding terms of service which protect the rights of the buyer. So you have situations like this where abuse happens or companies like Canary which made a rather big and infuriating change to their po…

We built a video security assistant that's completely autonomous. Hoping to start selling direct in a month or so.

Re: Ring fired employees for watching customer videos

#110

Post by sp332 » Thu, Jan 09, 2020, 8:08 PM UTC

AWildC182 wrote: post #64

booleanbetrayal wrote: post #29

Earlier quoted context omitted.

My neighbor, across the street, has a Ring camera aimed directly at my house, since that is where their front door faces. What is my recourse for preventing my private property from being recorded?

Find a 5mw near-infrared laser and aim it at the camera across the street

Seems like overkill, and potentially harmful (if someone gets their eye in the way of the beam, or even a pretty good reflection of the beam).