Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wanted to spy on my dog, ended up spying on TP-Link

kennedn.com

Post reply on HN
Print view View original

21–30 of 181 posts

Re: Wanted to spy on my dog, ended up spying on TP-Link

#21

Post by some_random »

bri3d wrote: post #18
mtlynch wrote: post #14

Earlier quoted context omitted.

It's a hardcoded default password, not a permanent backdoor. If I'm understanding the post correctly, the user changes it as part of the onboarding flow. This is the way most apps work if they have a default password the user is supposed to change.

The device should ideally have some kind of secret material derived per device, like a passphrase generated from an MCU serial number or provisioned into EEPROM and printed on a label on the device. Some form of "enter the code on the device" or "scan the QR code on the device" could then mutually authenticate the app using proof-of-presence rather than hardcoded passwords. This can still be done completely offline w…

If you buy the camera, plug it in, and forget to set it up, you just flat out can't use it right? I agree that proof of presence is way better but how many people are seriously going to be affected?

Re: Wanted to spy on my dog, ended up spying on TP-Link

#22

Post by bri3d »

201984 wrote: post #13

Are techniques like using Frida and mitmproxy on Android apps still going to be possible after the signing requirement goes into effect next year?

Overall: yes, but it will get much harder for apps which need attestation, which is sort of the point, for better or for worse. As far as I know you'll still be able to OEM unlock and root phones where it's always been allowed, like Pixels, but then they'll be marked as unlocked so they'll fail Google attestation. You should also be able to still take an app, unpack it, inject Frida, and sideload it using your _own_ developer account (kind of like you can do on iOS today), but it will also fail attestation and is vulnerable to anti-tampering / anti-debugging code at the application level.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#23

Post by bri3d »

some_random wrote: post #21
bri3d wrote: post #18

Earlier quoted context omitted.

The device should ideally have some kind of secret material derived per device, like a passphrase generated from an MCU serial number or provisioned into EEPROM and printed on a label on the device. Some form of "enter the code on the device" or "scan the QR code on the device" could then mutually authenticate the app using proof-of-presence rather than hardcoded passwords. This can still be done completely offline w…

If you buy the camera, plug it in, and forget to set it up, you just flat out can't use it right? I agree that proof of presence is way better but how many people are seriously going to be affected?

No, if you buy the camera, plug it in, and forget to set it up, then someone can use the default password and key material stored in the app to pretend to be the app and provision it on your behalf.

That's the only real vulnerability here, and it's no big deal, but it is A Thing and there is definitely a better way to do this that doesn't lose the freedom of full-offline.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#24

Post by some_random »

yannyu wrote: post #20
bri3d wrote: post #18

Earlier quoted context omitted.

The device should ideally have some kind of secret material derived per device, like a passphrase generated from an MCU serial number or provisioned into EEPROM and printed on a label on the device. Some form of "enter the code on the device" or "scan the QR code on the device" could then mutually authenticate the app using proof-of-presence rather than hardcoded passwords. This can still be done completely offline w…

AT&T routers, for example, ship like this. There's a wifi network and a wifi password printed onto the device. But that also means then that often anyone with physical access can easily get into the device. The complicated password provides an additional layer of illusion of security, because people then figure "it's not a default admin password, it should be good". The fundamental problem seems to be "many people ar…

If you have physical access you can just factory reset the device and onboard it with the normal flow though

Re: Wanted to spy on my dog, ended up spying on TP-Link

#25

Post by some_random »

bri3d wrote: post #23
some_random wrote: post #21

Earlier quoted context omitted.

If you buy the camera, plug it in, and forget to set it up, you just flat out can't use it right? I agree that proof of presence is way better but how many people are seriously going to be affected?

No, if you buy the camera, plug it in, and forget to set it up, then someone can use the default password and key material stored in the app to pretend to be the app and provision it on your behalf. That's the only real vulnerability here, and it's no big deal, but it is A Thing and there is definitely a better way to do this that doesn't lose the freedom of full-offline.

Ok yeah I think we're in agreement then.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#28

Post by paddleon »

xp84 wrote: post #15
hleszek wrote: post #9

Earlier quoted context omitted.

Home Assistant is making more and more sense to make your own fully local and private home automation system.

I love it! But my setup has a lot of sharp edges. It's a combo of things where the "standards compatible" way to connect to HA lacks things like camera control, by dastardly vendors like Chamberlain who basically killed HA support for spite, and finally, by having to use Google or Amazon for voice assistants. My #1 wish would be for someone to build a HA-native voice assistant speaker. I'd pay $100 each for a smart s…

you may be interested in https://www.home-assistant.io/voice-pe/

or

https://www.home-assistant.io/voice_control/thirteen-usd-voi...

Re: Wanted to spy on my dog, ended up spying on TP-Link

#29

Post by mystifyingpoi »

yannyu wrote: post #20
bri3d wrote: post #18

Earlier quoted context omitted.

The device should ideally have some kind of secret material derived per device, like a passphrase generated from an MCU serial number or provisioned into EEPROM and printed on a label on the device. Some form of "enter the code on the device" or "scan the QR code on the device" could then mutually authenticate the app using proof-of-presence rather than hardcoded passwords. This can still be done completely offline w…

AT&T routers, for example, ship like this. There's a wifi network and a wifi password printed onto the device. But that also means then that often anyone with physical access can easily get into the device. The complicated password provides an additional layer of illusion of security, because people then figure "it's not a default admin password, it should be good". The fundamental problem seems to be "many people ar…

Same with Orange branded ones. There is even a QR code that you can scan on your phone - no more typing 16-24 hex characters.

It's hard to decide whether it's good or bad. It is definitely easier. Which I guess matters most in consumer grade routers.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#30

Post by paddleon »

xp84 wrote: post #15
hleszek wrote: post #9

Earlier quoted context omitted.

Home Assistant is making more and more sense to make your own fully local and private home automation system.

I love it! But my setup has a lot of sharp edges. It's a combo of things where the "standards compatible" way to connect to HA lacks things like camera control, by dastardly vendors like Chamberlain who basically killed HA support for spite, and finally, by having to use Google or Amazon for voice assistants. My #1 wish would be for someone to build a HA-native voice assistant speaker. I'd pay $100 each for a smart s…

or roll your own.

This M5 Stack ASR unit costs $7.50, and has a vocab of about 40-70 words. That's enough to turn on/off lights and timers. You might need to come up with your own command language, but all of the ASR is extremely local

https://shop.m5stack.com/products/asr-unit-with-offline-voic...

Post reply on HN