Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

github.com

Post reply on HN
Print view View original

51–60 of 96 posts

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#51

Post by orbital-decay »

fakwandi_priv wrote: post #38
shakna wrote: post #19

Earlier quoted context omitted.

> I bet that security will be better. Not doxing myself, but... Company with a known name vibecoded a dashboard with Claude. Which also hardcoded a password into the client-side of the dashboard, which I caught. I reckon security will be about the same.

When I'm reading reviews of plans created by an agent especially on security boundaries it's suggesting huge matrixes to test even the very obscure situations, but then I'm also reading things like this and I just don't understand. Are we even using the same tools?

Tools are already preventing IoT companies from doing a ton of things they do, by default. It's a problem of the process, churn, and culture, not tools. I don't have any doubts that if given a coding agent that cares more than they do they'd still force it to hardcode a password or something because they feel like it's more convenient. Nobody cares there.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#52

Post by franga2000 »

fakwandi_priv wrote: post #38
shakna wrote: post #19

Earlier quoted context omitted.

> I bet that security will be better. Not doxing myself, but... Company with a known name vibecoded a dashboard with Claude. Which also hardcoded a password into the client-side of the dashboard, which I caught. I reckon security will be about the same.

When I'm reading reviews of plans created by an agent especially on security boundaries it's suggesting huge matrixes to test even the very obscure situations, but then I'm also reading things like this and I just don't understand. Are we even using the same tools?

A large part is also how much you read back what the model writes. The good models generally write quite secure code, but they also often implement temporary solutions that they tell you to fix later.

For example, if secret storage methods aren't specified in the prompts, a model might decide to be clever and implement a generic secret access interface, with a default implementation that hardcodes everything. It will probably tell you that this is not production ready and you should write or specify your preferred secret storage implementation, but if you don't read or understand that, you'll just leave it as is and push to prod.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#53

Post by astafrig »

Rohansi wrote: post #16
afavour wrote: post #13

Earlier quoted context omitted.

> It would be a no-go for non-techies. There are better solutions, like Apple’s HomeKit. I’m able to watch a camera that has no internet access because it passed through my Apple TV, which serves as a home hub. I didn’t have to set any of this up, it just works when you have the required hardware.

> I’m able to watch a camera that has no internet access because it passed through my Apple TV, which serves as a home hub. How exactly does this prevent the same kind of issue for Apple devices? Aren't you just trusting that Apple handles your data better than TP-Link? Not saying they don't but routing through another device doesn't really add security on its own.

Doesn’t it? I do trust the manufacturer of the thing that I keep within arms reach from the moment I get it, and which knows more about me than I do, to have better security than whatever the hell a TUYA is that controls the lights.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#54

Post by close04 »

forestry wrote: post #8
WarOnPrivacy wrote: post #5

Earlier quoted context omitted.

> Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited. Why single out bad Chinese coding? Bad US IoT coding has a longer history.

There’s bad, and then there’s egregious .

There’s egregious and there’s malicious.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#57

Post by ericpauley »

A shocking number of devices are continuously reporting location data over random unencrypted protocols. What’s worse, they’re often sending the data to cloud IPs that aren’t even controlled by the company, so some random person is getting your real-time location.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#58

Post by inigyou »

Namidairo wrote: post #26
copperx wrote: post #6

Earlier quoted context omitted.

All of there IoT devices will be slop coded soon, and I wonder whether that will be an improvement or not. I bet that security will be better.

> All of there IoT devices will be slop coded soon Soon? I've already seen multiple of TP-Link's firmware engineers leave their LLM history public and indexed by search engines. It's quite obviously them as well.

How did you find that?

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#59

Post by inigyou »

locknitpicker wrote: post #29
drnick1 wrote: post #4

This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited.

> This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. TP-Link is a prominent maker of network hardware, including home and mesh routers.

And their network hardware is illegal to import into the USA because it's full of backdoors.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#60

Post by afavour »

Rohansi wrote: post #16
afavour wrote: post #13

Earlier quoted context omitted.

> It would be a no-go for non-techies. There are better solutions, like Apple’s HomeKit. I’m able to watch a camera that has no internet access because it passed through my Apple TV, which serves as a home hub. I didn’t have to set any of this up, it just works when you have the required hardware.

> I’m able to watch a camera that has no internet access because it passed through my Apple TV, which serves as a home hub. How exactly does this prevent the same kind of issue for Apple devices? Aren't you just trusting that Apple handles your data better than TP-Link? Not saying they don't but routing through another device doesn't really add security on its own.

> Aren't you just trusting that Apple handles your data better than TP-Link?

I am, yes. Ultimately you’re going to need to trust some hardware, somewhere. No matter what you’re doing you have to trust that your home router doesn’t have an externally accessible SSH port with no password set.

Personally I trust Apple more than I trust TP Link with this stuff.

Post reply on HN