Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

Post reply on HN
Print view View original

111–120 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#111

Post by dhosek »

tclancy wrote: post #43
JTbane wrote: post #29

Earlier quoted context omitted.

>Anyone who cares about security I have something hilarious to tell you about IoT apps

A Venn diagram like a 6th grade boy's graffiti of boobs.

Just as a pedantic aside, people often use Venn diagram when they mean Euler diagram. A Venn diagram always has the overlapping circles and use shading or labeling describe the set relation. Euler diagrams let the circles describe the relation so two non intersecting sets in a Venn diagram might share the left circle green, the right blue and leave the intersection blank or grey. An Euler diagram will have two disjoint circles.

Re: My security camera shipped a GitHub admin token in its login page

#112

Post by petepete »

tehlike wrote: post #71
petepete wrote: post #70

Earlier quoted context omitted.

I live by this rule*. Being able to pick up stuff from IKEA that's well supported, well designed and really affordable is a huge advantage. *almost, I have two things that need an app. My Vaillant boiler and my Yale alarm system. Both apps are terrible, but I have a 10 year warranty on the boiler and my alarm is up to scratch from a home insurance point of view.**

Yale alarm? Can you link? Vailant boiler - I wonder if there's a debug interface you can use. Not knowing specifics of your model, i foudn this: https://github.com/jayme-github/esphome_vaillant Codex can help probably further heh.

It's a Yale Sync

https://yalehome.co.uk/yale-sync-hub

It's not really something I want 'home rolled', I just want it to work.

Same goes for the boiler really. If it stops working I can phone Valliant and they'll send someone round to fix it.

Re: My security camera shipped a GitHub admin token in its login page

#113

Post by KPGv2 »

grommz wrote: post #4

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

> Department of War

n.b., it's the Department of Defense, just like the Kennedy Center doesn't have Trump's name attached, and the large body of water by Texas is the Gulf of Mexico.

Re: My security camera shipped a GitHub admin token in its login page

#114

Post by asveikau »

My cameras are analog rather than PoE or IP based, but that's just because I set up the initial iteration of the system a long time ago. The standard now is to give your camera an IP address.

With many IoT type things I block access to the public internet. I think with cameras specifically a lot of people even set it up physically on a different network that can only talk to the NVR.

But tldr, basing the cameras on IP invites some of the things in this article. Anyone deploying these devices needs to think about securing them.

Re: My security camera shipped a GitHub admin token in its login page

#116

Post by 1718627440 »

netsharc wrote: post #3
RyJones wrote: post #2

When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites. You can curse the storm, but the wind will come.

how did "same MAC" lead to "access to everything"? Was the website's security based on MAC, which presumably is supplied by the client? If so, I guess.. typical IoT.

How does this even work? A website doesn't know your MAC, that is only known in your local network.

Re: My security camera shipped a GitHub admin token in its login page

#117

Post by toast0 »

SV_BubbleTime wrote: post #82
iso1631 wrote: post #35

Earlier quoted context omitted.

192.168.0.0/24 -> fd00:0::/64 192.168.1.0/24 -> fd00:1::/64 192.168.2.0/24 -> fd00:2::/64 192.168.240.0/24 -> fd00:240::/64 It's not a great idea, but its no harder. No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem. Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for…

I doubt any endpoints are entirely ipv6. So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow. I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for. No human said “hey, network…

> I doubt any endpoints are entirely ipv6.

Lte and 5G can be v6 only, usually they also have NAT64 and DNS64 so you can get everywhere, but the less stuff that needs v4, the smaller their nat boxes are.

Re: My security camera shipped a GitHub admin token in its login page

#118

Post by inigyou »

SV_BubbleTime wrote: post #77
inigyou wrote: post #54

Earlier quoted context omitted.

All global IPv6 addresses start with 2. This is by design. Pedantically, 3 is also reserved for global. Some other prefixes are also reserved, like fd for the ULA (local) range. The point of IPv6 was to make the addresses so long they are easy to manage.

>The point of IPv6 was to make the addresses so long they are easy to manage. lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.

How many /24s does your organisation have? With IPv6, one block is almost always sufficient.

Re: My security camera shipped a GitHub admin token in its login page

#119

Post by inigyou »

DrewADesign wrote: post #109
tracker1 wrote: post #80

Earlier quoted context omitted.

I know that on my hosted server, I never bothered to set it up, because I didn't know how to properly configure or sub-net it. I know it's skill issue, but really feels significantly more complicated and even harder to understand than NAT even. Not to mention, at home, most of the ads I do see (PiHole) are IPv6 addresses.

It seems to have absolutely terrible ergonomics as a technology, in nearly every conceivable way.

It's literally impossible to avoid long addresses being long or short addresses running out. One of those is a worse problem.
Post reply on HN