Live data from Hacker News

Read this before you buy that TV streaming stick

krebsonsecurity.com

21–30 of 575 posts

Re: Read this before you buy that TV streaming stick

#21
post #19

So where can I get an actual privacy focused streaming box, even if the apps (Neflix etc) running on it are not?

I'm increasingly being convinced the only way to do that is you do a media pc nuc. The problem, of course, is you probably won't have the netflix app. It's painful to setup such a box to stream from various services.

Re: Read this before you buy that TV streaming stick

#22

> generic TV boxes that promise unlimited content streaming for a one-time fee I don't want to blame the purchasers of these things - who are some of the victims - but at the same time, it does seem like a Too Good To Be True situation.

Uhh, I have an extended family member, who not only uses it, but now also tries to get other people to get into it. Since I was familiar with this practice ( and the issues it makes worse ), I noted those to him in an attempt to both politely decline and, hopefully, spare him, and society, some future problems. Without going into any identifying details, he didn't take it well ( and I don't think I got on my high horse ).

Anyway, I think some level of blame is warranted.

Re: Read this before you buy that TV streaming stick

#23
post #19

So where can I get an actual privacy focused streaming box, even if the apps (Neflix etc) running on it are not?

Apple TV is currently the best balance of privacy and convenience. The only way to get more private is using a PC, but that limits the resolution for most streaming services to 720p or 1080p.

Re: Read this before you buy that TV streaming stick

#25
post #19

So where can I get an actual privacy focused streaming box, even if the apps (Neflix etc) running on it are not?

I'm increasingly being convinced the only way to do that is you do a media pc nuc. The problem, of course, is you probably won't have the netflix app. It's painful to setup such a box to stream from various services.

I tried going that route, but most apps for streaming are Android. And that was only one of the issues.

It was a rabbit hole and in the end I got back using my NVIDIA Shield. This is about 10 years now, but it’s actually still the best option.

Re: Read this before you buy that TV streaming stick

#26
I do not see problems with fake ad clicks and have no sympathy for ad companies.

Also pre-installed adware is not a surprise, I found adware in the official firmware image of a certain Chinese tablet.

What worries me much more is backdoors from the foreign companies and governments that can be pre-installed at the factory to collect intelligence information. For example, I became aware that a certain maker of a popular mobile OS was collecting the cell tower IDs and WiFi access point identifiers along with GPS coordinates of a device. Obviously they collect this information to be able to guide missiles and drones when GPS signal is jammed (GPS is very low power and easy to jam). This is not acceptable.

How can we prevent this? I think, for every imported device having a CPU and Internet connectivity:

- the user must be able to re-flash firmware with their own code.

- the local government must have access to the full source code and be able to search for vulnerabilities or backdoors, including using AI tools. Found vulnerabilities are considered a reward and may be used against countries not doing inspections. No access - no import permission.

- any telemetry or data collection, or updates must be opt-in only and disabled by default.

- any telemetry or updates must go through a server controlled by the local government, in unencrypted form, to detect attempts to collect intelligence information or install malicious update.

Sadly our government instead only demands that manufacturers pre-install their closed-source software on all imported devices and that's all.

Re: Read this before you buy that TV streaming stick

#27

In this case it’s actual malice, that the streaming stick is set up for residential proxy and ad fraud straight from the factory. But incompetence can lead to the same place if it’s a poorly engineered, un-maintained device with an old version of Android that will never be patched and is always one no-click exploit away from being commandeered into residential proxy and ad fraud.

I wonder to what degree malice can be engineered to look like incompetence?

Try examining the old entries from the https://en.wikipedia.org/wiki/Underhanded_C_Contest.

Re: Read this before you buy that TV streaming stick

#28
post #20

Brazil. Last year I effectively blocked Brazil for a while. Ultimately I settled on three possibilities for the traffic I was seeing: 01: DDOS 10: Residential proxies 11: Somebody DDOSing residential proxies

I can’t prove it, but I live in Brazil and after getting a smart TV from LG, I started receiving challenges across all Google services, indicating they received bot traffic from my network. I only used apps from streaming services I actually paid for.

I suspect these TVs either come with residential proxies set up from the factory, or they have such poor security that they’re instantly hacked. Either way, TV manufacturers (including reputable ones like LG) are to blame.

Re: Read this before you buy that TV streaming stick

#29

> generic TV boxes that promise unlimited content streaming for a one-time fee I don't want to blame the purchasers of these things - who are some of the victims - but at the same time, it does seem like a Too Good To Be True situation.

It could be possible, I haven't done the math though.

Stremio +Torbox is $3/month and they can probably share 10+ households on one TorBox account so it could work out. The seller could just stop paying the TorBox subscription at whatever point and they have an incentive to do so.

Re: Read this before you buy that TV streaming stick

#30

> generic TV boxes that promise unlimited content streaming for a one-time fee I don't want to blame the purchasers of these things - who are some of the victims - but at the same time, it does seem like a Too Good To Be True situation.

Well now I want one

Stremio+TorBox are the two words. ($3/month)
Post reply on HN