Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

Post reply on HN
Print view View original

71–80 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#71

Post by tehlike »

petepete wrote: post #70
tehlike wrote: post #67

Earlier quoted context omitted.

Another rule of thumb - i know it's not always the best since some products are really nice aesthetically - is to buy only local smart stuff, for example, zigbee/zwave.

I live by this rule*. Being able to pick up stuff from IKEA that's well supported, well designed and really affordable is a huge advantage. *almost, I have two things that need an app. My Vaillant boiler and my Yale alarm system. Both apps are terrible, but I have a 10 year warranty on the boiler and my alarm is up to scratch from a home insurance point of view.**

Yale alarm? Can you link?

Vailant boiler - I wonder if there's a debug interface you can use. Not knowing specifics of your model, i foudn this: https://github.com/jayme-github/esphome_vaillant

Codex can help probably further heh.

Re: My security camera shipped a GitHub admin token in its login page

#72

Post by makr17 »

hhh wrote: post #5
grommz wrote: post #4

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

I used to work somewhere that did that. Several of us in Eng pointed out that it was likely impossible to sell anything to DoD personnel since the reply would route internally. But I don't know if it was _fixed_, was still an issue when I left.

Re: My security camera shipped a GitHub admin token in its login page

#74

Post by unethical_ban »

Matuzy wrote: post #31
inigyou wrote: post #23

Earlier quoted context omitted.

Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range. If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.

> Yet another thing ipv6 solves. ... it's unlikely to conflict with the current global range I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.

Respectfully I don't think they explained it well.

fc00::/7 is for "Unique Local Addresses". Basically, private, non-globally-routable addresses from which you can freely pick space. Kind of like RFC1918. It's deliberately huge and you should only use as much from it as you need. The idea being that if you merge with another organization or connect to them via VPN, it's unlikely your addresses will collide like with RFC 1918.

There's even a website (sites?) to register your ULA space on a volunteer basis to reduce collision chances.

Re: My security camera shipped a GitHub admin token in its login page

#75

Post by tracker1 »

ErroneousBosh wrote: post #15
hhh wrote: post #5

Earlier quoted context omitted.

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated". You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.

LOL, they should have just used a 10.x space instead if they wanted slightly simpler numbers.

On the shotgun, or adjacent, I do tend to prefer ammo classes for my nets... 10.22.x.y, where x may be 1, 38, 45, etc. Allows for site to site vpn with friends/family a bit easier to remember.

Re: My security camera shipped a GitHub admin token in its login page

#76

Post by sophacles »

caruasdo wrote: post #73

I know you're a mastermind when it comes to security, but you should provide more context about the tools and methods you're using in your article so we can better understand what it's all about and not have to Google every single step you're taking.

Seemed perfectly reasonable to me. Not everything has to be written for a target audience that includes you, besides you were able to look up what you needed it seems. Another tactic is to feed the article to your favorite LLM and interrogate it about what you don't understand.

Re: My security camera shipped a GitHub admin token in its login page

#77

Post by SV_BubbleTime »

inigyou wrote: post #54
Matuzy wrote: post #31

Earlier quoted context omitted.

> Yet another thing ipv6 solves. ... it's unlikely to conflict with the current global range I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.

All global IPv6 addresses start with 2. This is by design. Pedantically, 3 is also reserved for global. Some other prefixes are also reserved, like fd for the ULA (local) range. The point of IPv6 was to make the addresses so long they are easy to manage.

>The point of IPv6 was to make the addresses so long they are easy to manage.

lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.

Re: My security camera shipped a GitHub admin token in its login page

#78

Post by tracker1 »

jabart wrote: post #47
ErroneousBosh wrote: post #15

Earlier quoted context omitted.

I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated". You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.

Didn't AT&T do that and Cloudflare made them change it when they aquired that space?

I got a "home" Verizon box, and the first thing I did was change the DNS setting... 1.1.1.1 wasn't working, and I wanted to change it back to default. Verizon's tech support are idiots... they literally wouldn't give me the default DNS IP because they were concerned about security.

Google's DNS worked fine, but Cloudflare's didn't. No idea if they ever fixed it... I'm using it as a backup for my main connection, eventually I'll setup autofailover on my router (OpnSense). For now, I just swap the cables.

Re: My security camera shipped a GitHub admin token in its login page

#79

Post by sophacles »

JTbane wrote: post #29
Ecsta wrote: post #14

Earlier quoted context omitted.

There's a lot of public keys that don't give you any special access, unless the dev is really bad. Anyone who cares about security will be using App Attest or the Google store equivalent.

>Anyone who cares about security I have something hilarious to tell you about IoT apps

The "S" in IoT stands for security!

Re: My security camera shipped a GitHub admin token in its login page

#80

Post by tracker1 »

SV_BubbleTime wrote: post #77
inigyou wrote: post #54

Earlier quoted context omitted.

All global IPv6 addresses start with 2. This is by design. Pedantically, 3 is also reserved for global. Some other prefixes are also reserved, like fd for the ULA (local) range. The point of IPv6 was to make the addresses so long they are easy to manage.

>The point of IPv6 was to make the addresses so long they are easy to manage. lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.

I know that on my hosted server, I never bothered to set it up, because I didn't know how to properly configure or sub-net it. I know it's skill issue, but really feels significantly more complicated and even harder to understand than NAT even.

Not to mention, at home, most of the ads I do see (PiHole) are IPv6 addresses.

Post reply on HN