Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

Post reply on HN
Print view View original

241–250 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#241

Post by necovek »

shakna wrote: post #220
necovek wrote: post #202

Earlier quoted context omitted.

As an — I am guessing — American, you should feel more comfortable with handing over your domestic surveillance to Russia or China than to a US-based company. They absolutely have no interest in your domestic matters, nor do they have a clear path to monetize your attention. There are non-IP cameras and coax interfaces, which would expose a USB video device on any Linux system, RPi included. Plenty of software to han…

> They absolutely have no interest in your domestic matters This is categorically, not true, I'm afraid. Reaching into domestic networks, where you can find influential people through mass harvesting, is an actively exploited technique by the spy agencies of our world. How do you find the gardener of someone influential? You target all gardeners.

We are talking here about someone at least technically savvy who would know if they are of interest or not (ok, maybe not). They'd also be able to monitor their outgoing traffic.

We are also not talking about a potential Russian product that will reach into large number of homes since — being paid and privacy focused — it is already a niche product. So getting into someone's home of interest would need a lot of luck, and there are probably better ways to do it.

Re: My security camera shipped a GitHub admin token in its login page

#242

Post by shakna »

necovek wrote: post #241
shakna wrote: post #220

Earlier quoted context omitted.

> They absolutely have no interest in your domestic matters This is categorically, not true, I'm afraid. Reaching into domestic networks, where you can find influential people through mass harvesting, is an actively exploited technique by the spy agencies of our world. How do you find the gardener of someone influential? You target all gardeners.

We are talking here about someone at least technically savvy who would know if they are of interest or not (ok, maybe not). They'd also be able to monitor their outgoing traffic. We are also not talking about a potential Russian product that will reach into large number of homes since — being paid and privacy focused — it is already a niche product. So getting into someone's home of interest would need a lot of luck,…

The current observed strategy, broadcast by ASIO chief Mike Burgess, in 2025, is "if there is a way in, use it". Being niche is not a defense. Being a nobody is not a defense.

Every product is useful in some way.

Targeting everyone, rather than some, is precisely how America's government networks were breached. Everyone is of interest. Because everyone is connected to someone else. Six degrees of separation, or the real world equivalent, means that everyone provides a soft target for achieving access to someone else.

There are better, more targeted approaches. Which is why both are done. One doesn't preclude the other.

Re: My security camera shipped a GitHub admin token in its login page

#243

Post by tehnoble »

zrobotics wrote: post #165
badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

Not exactly open firmware, but something like ONVIF on an isolated network is pretty close. An ONVIF camera should talk to basically any NVR (network video recorder), there are several open-source ones available. There are tons of ONVIF-compliant and cheap PoE cameras, and with this setup you really don't care about the security of the manufacturer firmware since you aren't exposing them to the network publicly. Howe…

For anyone who wants a setup like this but the nice notifications and quality of life capabilities (recordings, easy remote access for family), and are ok being on Apple infra (end to end encrypted) -

ONVIF camera (or one compatible with Scrypted) Block WAN (ideally, VLAN) on the cheap cameras Home computer to run Scrypted AppleTV (for Apple home bridge)

This is what I moved to after getting away from Ring and it works quite well. Reolink cams, old desktop, and an hour of setup.

Re: My security camera shipped a GitHub admin token in its login page

#244

Post by ece »

ungreased0675 wrote: post #221
ece wrote: post #185

Earlier quoted context omitted.

Pinecube from pine64. https://pine64.org/devices/pinecube/

Would it be so difficult to include a simple plastic case? Having to find/design 3D printed cases adds time to getting these projects set up. I don’t have a 3D printer and have to go to the local maker space to make anything.

Yeah, this does seem like a needless omission. Cardboard cases work sometimes. Plastic cases aren't too hard to find, but they do require modifications.

Re: My security camera shipped a GitHub admin token in its login page

#245

Post by itsbczurstupid »

inigyou wrote: post #234
DrewADesign wrote: post #172

Earlier quoted context omitted.

Fling it around? There are a shitload of people who maintain networks, like home or small business networks, that aren’t network administrators. Most of those people are not prepared to have their Chinese WiFi cameras, myriad smart appliances, and heck, even home computers easily individually accessible from the internet. It’s an extremely simple concept, no?

Actually I think most people really do want that stuff accessible from the internet. Currently that requires a central server and a subscription, but imagine if it didn't. Imagine if you could log into your washing machine from anywhere instead of only when you're at home, and it would keep working even if LG went bankrupt.

[dead]

Re: My security camera shipped a GitHub admin token in its login page

#246

Post by DrewADesign »

inigyou wrote: post #235
DrewADesign wrote: post #232

Earlier quoted context omitted.

You’re right. That’s why everybody uses it and nobody is confused by it.

Everyone whose ISP offers it uses it, yes.

Do they manage their ISP’s network? Don’t be pedantic.

Re: My security camera shipped a GitHub admin token in its login page

#247

Post by dhosek »

tclancy wrote: post #173
dhosek wrote: post #111

Earlier quoted context omitted.

Just as a pedantic aside, people often use Venn diagram when they mean Euler diagram. A Venn diagram always has the overlapping circles and use shading or labeling describe the set relation. Euler diagrams let the circles describe the relation so two non intersecting sets in a Venn diagram might share the left circle green, the right blue and leave the intersection blank or grey. An Euler diagram will have two disjoi…

A. I love a pedantic aside B. I love that Euler is pronounced “oiler” which is North American slang for a drunk. I’ve been trying to find that constant my whole adult life.

I learned the correct pronunciation when someone laughed at me at a TeX conference in the 80s when I made a reference to the You-ler fonts. In my single semester of high school German I was either never taught or ignored the teacher when the pronunciation of eu was given (or perhaps I just never connected it with Euler).

Re: My security camera shipped a GitHub admin token in its login page

#248

Post by allarm »

LocalH wrote: post #176
DrewADesign wrote: post #172

Earlier quoted context omitted.

Fling it around? There are a shitload of people who maintain networks, like home or small business networks, that aren’t network administrators. Most of those people are not prepared to have their Chinese WiFi cameras, myriad smart appliances, and heck, even home computers easily individually accessible from the internet. It’s an extremely simple concept, no?

NAT is good. It's CGNAT that's bad, because that's NAT imposed on subscribers, and not NAT that they control.

> NAT is good.

It isn't. Routing is good though.

Re: My security camera shipped a GitHub admin token in its login page

#249

Post by allarm »

antonvs wrote: post #188
edwinjm wrote: post #154

Earlier quoted context omitted.

The DoWD owns such a large chunk of the IP space, it can very easily be a coincidence

That they used a public IP as an internal IP? That’s simply a mistake.

It's how Internet was supposed to work. NAT was a forced mistake, as well as the whole concept of "public" and "internal" address spaces.

Re: My security camera shipped a GitHub admin token in its login page

#250

Post by numpad0 »

mschuster91 wrote: post #227
numpad0 wrote: post #158

Earlier quoted context omitted.

Not exactly what you have asked for, but ESP32 based M5Stack and Seeed Xiao modules might fit the bill. They are not so expensive, are Linux-free, and there's no report so far of secret ping home features in the SDK.

ESP32 are powerful enough to run realtime image processing?! Wtf.

  https://docs.m5stack.com/en/unit/poe_cam
Post reply on HN