Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

evilsocket.net

Post reply on HN
Print view View original

11–20 of 128 posts

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#11

Post by formerly_proven »

aaronax wrote: post #3

This is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities? There must be many millions sold. Quite handy for some intel agencies. I assume any Wi-Fi camera under $150 has basically the same problems. I guess the only way to run a security camera where you don't have Ethernet is to use a non-proprietary Wi-Fi 10…

> I assume any Wi-Fi camera has basically the same problems.

ftfy

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#13

Post by 2gremlin181 »

walterbell wrote: post #6
shreddit wrote: post #5

As soon as i read the author used grok as an ai assistant, i was somehow less interested to keep on reading. Not because of the usage of ai, but the chosen provider. (I don’t know whether grok is just the best choice for this kind of work.) Is it wrong to judge people for their choice of ai providers?

Which AI providers have access to real-time Twitter data?

Genuinely curious, what are some use cases that you require live Twitter data in your LLM for?

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#15

Post by [deleted] »

shreddit wrote: post #5

As soon as i read the author used grok as an ai assistant, i was somehow less interested to keep on reading. Not because of the usage of ai, but the chosen provider. (I don’t know whether grok is just the best choice for this kind of work.) Is it wrong to judge people for their choice of ai providers?

[deleted]

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#16

Post by tehlike »

JaggedJax wrote: post #2

It's probably fair to assume that most of their other camera models are affected by the same or similar issues. It looks like they pump out quite a few models that I image have similar firmware. This page[1] lists the C200 as last having a firmware update in October, but also lists the latest version as 1.4.4 while the article lists 1.4.2. It seems like they have pushed other updated in this time, but not these secur…

They lend themselves to local connections, however, so they are workable for the tech savvy.

Definitely a problem for regular users.

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#17

Post by tehlike »

aaronax wrote: post #3

This is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities? There must be many millions sold. Quite handy for some intel agencies. I assume any Wi-Fi camera under $150 has basically the same problems. I guess the only way to run a security camera where you don't have Ethernet is to use a non-proprietary Wi-Fi 10…

Some cameras that "charge" with USB also can use a USB network adapter (provided they can supply power).

For the tech savvy, there is thingino as a firmware alternative - works local only, no cloud, and supports mqtt etc.

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#18

Post by fylo »

aaronax wrote: post #3

This is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities? There must be many millions sold. Quite handy for some intel agencies. I assume any Wi-Fi camera under $150 has basically the same problems. I guess the only way to run a security camera where you don't have Ethernet is to use a non-proprietary Wi-Fi 10…

Don't put them on untrusted networks. This always seemed obvious to me.

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#19

Post by notjosh »

SilverElfin wrote: post #14

So which camera brand has adequately designed software? It’s hard to know as a consumer what to trust or not trust, because how do you evaluate the quality of their work when the device SEEMS to work as expected? Is Ring the only choice?

I've installed Thingino on my cameras such as this. Cheap camera + custom (local only!) firmware is a good solution imo.

No guarantee that it'll be perfect either, obviously, but it's open source and actively maintained. Highly recommended.

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#20

Post by blibble »

walterbell wrote: post #6
shreddit wrote: post #5

As soon as i read the author used grok as an ai assistant, i was somehow less interested to keep on reading. Not because of the usage of ai, but the chosen provider. (I don’t know whether grok is just the best choice for this kind of work.) Is it wrong to judge people for their choice of ai providers?

Which AI providers have access to real-time Twitter data?

when has anything of value been posted on twitter?
Post reply on HN