Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

Post reply on HN
Print view View original

161–170 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#161

Post by redeeman »

DrewADesign wrote: post #156
inigyou wrote: post #119

Earlier quoted context omitted.

It's literally impossible to avoid long addresses being long or short addresses running out. One of those is a worse problem.

The length isn’t the only thing that makes the ergonomics suck. The lack of backwards compatibility sucks. The “you don’t have to use NAT anymore” is great theoretically, but it renders a lot of casual network maintainers mental model of network security obsolete without a clear and simple alternative. The shorthand is not intuitive (though it’s not CIDR-level counterintuitive). Really, there’s way too much about wor…

you fling around words like "network maintainers" quite casually, dont you? :)

its really extremely simple, just dont NAT, is that really so hard? just because you dont NAT, doesnt mean you have to let the traffic pass through, that is also an extremely simple concept, no?

Re: My security camera shipped a GitHub admin token in its login page

#164

Post by glitchcrab »

daneel_w wrote: post #61
folkrav wrote: post #51

Earlier quoted context omitted.

There’s some irony to security not being a priority for security cameras. Different kind of security I know, but still.

There's also some irony in people happily ignoring that so many of these products live-stream the inside view of their homes and offices to some foreign corporate cloud - and in the case of suspiciously many Chinese security cameras, a state-backed corporation's cloud. Because, wow, it really is convenient.

Which is exactly why alll my cameras live in their own VLAN with no internet access, regardless of how trustworthy the company may be. Better safe than sorry and all that.

Re: My security camera shipped a GitHub admin token in its login page

#165

Post by zrobotics »

badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

Not exactly open firmware, but something like ONVIF on an isolated network is pretty close. An ONVIF camera should talk to basically any NVR (network video recorder), there are several open-source ones available.

There are tons of ONVIF-compliant and cheap PoE cameras, and with this setup you really don't care about the security of the manufacturer firmware since you aren't exposing them to the network publicly. However, you do need to be extra diligent when configuring your VLAN/network segmentation.

Re: My security camera shipped a GitHub admin token in its login page

#166

Post by zrobotics »

tracker1 wrote: post #75
ErroneousBosh wrote: post #15

Earlier quoted context omitted.

I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated". You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.

LOL, they should have just used a 10.x space instead if they wanted slightly simpler numbers. On the shotgun, or adjacent, I do tend to prefer ammo classes for my nets... 10.22.x.y, where x may be 1, 38, 45, etc. Allows for site to site vpn with friends/family a bit easier to remember.

I dunno, seems like it could be a bit vague. Does 45 refer to 45 Webley or 45 GAP? Could possibly also refer to 45 Colt I guess, if you're boring. But 45 Colt, 45 ACP, 45 Colt Government?

Also, just in case this comment isn't pedantic enough, 10.22 would be a firearm range, not an ammo range. And AFAIK they only ever chambered that for .22 rimfire cartridges. ;)

Re: My security camera shipped a GitHub admin token in its login page

#167

Post by bityard »

ethin wrote: post #157
tracker1 wrote: post #78

Earlier quoted context omitted.

I got a "home" Verizon box, and the first thing I did was change the DNS setting... 1.1.1.1 wasn't working, and I wanted to change it back to default. Verizon's tech support are idiots... they literally wouldn't give me the default DNS IP because they were concerned about security. Google's DNS worked fine, but Cloudflare's didn't. No idea if they ever fixed it... I'm using it as a backup for my main connection, even…

My ISP won't give me the router credentials because they claim that that would somehow risk their network interconnectivity or something. I have no idea how this makes any sense since a router (shouldn't) give me that level of access, but maybe I'm missing something?

If the router is also the modem, it can have diagnostic stuff that could (I am careful to point out: theoretically) cause them a big support headache in one way or another.

Also, I had a DSL modem back in the day with its own terrible NAT built-in. I managed to log in (I may have been given the admin password from a friend who worked at the ISP, allegedly) and once I put it into bridge mode, I was able to acquire multiple public IPv4 addresses via DHCP.

Re: My security camera shipped a GitHub admin token in its login page

#168

Post by zrobotics »

walrus01 wrote: post #65
kingleopold wrote: post #37

Earlier quoted context omitted.

Note to self: never buy any Korean hardware or software product. /S

Note to self, never buy any hardware product, move to a yurt in the woods, start an alpaca ranch, write a manifesto

Oldie, bur relevant.

Tech enthusiasts: My entire house is smart.

Tech workers: The only piece of technology in my house is a printer and I keep a gun next to it so I can shoot it if it makes a noise I don’t recognize

Re: My security camera shipped a GitHub admin token in its login page

#169

Post by bityard »

kotaKat wrote: post #6
hhh wrote: post #5

Earlier quoted context omitted.

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

there's a couple subnets I (ab)use in the DOD IP space for my home network knowing they'd never put them on the open internet. it's also fun to throw logging for a loop if someone digs. 22.0.0.0/8 - it's basically free real estate!

The CGNAT space (100.64.0.0/10) is also free real estate for container virtual/overlay networks when you don't want to (or can't, thanks to IT) use the RFC-1918 subnets.

Re: My security camera shipped a GitHub admin token in its login page

#170

Post by zrobotics »

whalesalad wrote: post #9

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

Ugh, that's a new low. I can't think of a single good reason a lighting app would need shopify api access.

That said, I've done some consulting work on shopify stores, and I wouldn't be shocked at all to see something like that at all. The bar for code quality that a lot of low end consultants/designers deliver is just abysmal.

Post reply on HN