Vendors must start adding physical on/off switches to devices that can spy on us • Hacker News Board

Re: Vendors must start adding physical on/off switches to devices that can spy on us

#101

Post by HALtheWise » Sat, Apr 20, 2019, 9:58 PM UTC

Am I the only one who has far more sensitive content visible on the screen and filesystem of my computer than through its camera? I feel like, at least for the threat models that I consider likely, if someone manages to hack my laptop and get (for example) microphone access, the thing I am most worried about is that they will use acoustic analysis of keystrokes to recover my banking password, not that they will hear me... singing in the shower, I guess? Based on my understanding of current laptop OS's, just directly making a key-logger the straightforward way is easier anyway, so I'm not that concerned.

I fear that the sense of security people feel from putting tape over their webcam might be hiding much more realistic threats.

Re: Vendors must start adding physical on/off switches to devices that can spy on us

#102

Post by m463 » Sat, Apr 20, 2019, 10:24 PM UTC

zw123456 wrote: post #4

Note that a physical switch can be overridden just as easy as a soft switch, the vendor can just put a soft switch in parallel with it and you would never know it. The hard switch could turn off the display, speaker etc. while the processor and radio can stay on.

Although this seems like a ridiculous comment, people should realize soft switches are super common.

For one (silly but common) example, you can turn off your iphone, but it will turn back on if it's plugged into a charger.

Re: Vendors must start adding physical on/off switches to devices that can spy on us

#103

Post by m463 » Sat, Apr 20, 2019, 10:26 PM UTC

walterbell wrote: post #17

Thanks to Purism laptops and phone for taking the lead on kill switches for sensors, https://puri.sm/learn/hardware-kill-switches/

Now if they would only LABEL THE FREAKING SWITCH. (I have one, and I'm never quite sure which direction is off)

Re: Vendors must start adding physical on/off switches to devices that can spy on us

#104

Post by _bxg1 » Sat, Apr 20, 2019, 10:28 PM UTC

HALtheWise wrote: post #101

Am I the only one who has far more sensitive content visible on the screen and filesystem of my computer than through its camera? I feel like, at least for the threat models that I consider likely, if someone manages to hack my laptop and get (for example) microphone access, the thing I am most worried about is that they will use acoustic analysis of keystrokes to recover my banking password, not that they will hear…

In any security conversation, the vector one should care about is the path of least resistance.

Re: Vendors must start adding physical on/off switches to devices that can spy on us

#105

Post by scottlegrand2 » Sat, Apr 20, 2019, 10:36 PM UTC

rudolfwinestock wrote: post #24

Janie Crane: “An off switch?” Metrocop: “She'll get years for that. Off switches are illegal!” —Max Headroom, season 1, episode 6, “The Blanks” https://www.maxheadroom.com/index.php?title=Episode_ABC.1.6:...

"Blank is Beautiful!" - same episode

Ahead of its time apparently...

Re: Vendors must start adding physical on/off switches to devices that can spy on us

#106

Post by 6nf » Sat, Apr 20, 2019, 10:53 PM UTC

bookofjoe wrote: post #85

narrator wrote: post #60

TVs and other gadgets that have no microphones or video cameras embedded in them should have a certification like "organic". "NoSpy Certified" or a similar trademark would be appropriate right next to the UL and CE marks.

Would "NoSpy Certified" also cover the NSA et al?

It would mean that only your local spy agency has access!

Re: Vendors must start adding physical on/off switches to devices that can spy on us

#107

Post by hombre_fatal » Sat, Apr 20, 2019, 11:00 PM UTC

beenBoutIT wrote: post #63

nothrabannosir wrote: post #58

Earlier quoted context omitted.

I thought lying about such functionality to consumers would be illegal. I feel that if you sell me a device with the explicit promise that “off means off”, then bypassing that would be.. false advertising? Is that true? Assuming they’d market it that way, originally?

Most people aren't capable of using a webcam correctly before the addition of a mechanical switch that adds a 50% chance they'll deactivate it and think it's broken. A physical hand-operated integrated cover that slides in front of the camera is a great option for software engineers and HN-level thinkers, but it will only cause grief for the majority of users. Having hidden redundancy would allow Apple's tech support…

An example of this in practice is how the iPhone's bluetooth and wifi disable switches on the fast access menu only work for 24 hours.

Re: Vendors must start adding physical on/off switches to devices that can spy on us

#108

Post by 6nf » Sat, Apr 20, 2019, 11:02 PM UTC

snaky wrote: post #19

briandear wrote: post #12

Earlier quoted context omitted.

The purpose of a webcam is to spy?

Could we ask any Chinese webcam vendors - which are constantly upload the stream to some Chinese clouds - what the main purpose of their devices is?

Oh it's for convenience so I can log in remotely and view my camera, pay no attention to the Chinese server farm in the middle.

Re: Vendors must start adding physical on/off switches to devices that can spy on us

#109

Post by tgb » Sat, Apr 20, 2019, 11:05 PM UTC

BenjiWiebe wrote: post #96

monocasa wrote: post #90

Earlier quoted context omitted.

USDA organic allows non organic pesticides and herbicides. It's a joke of a standard.

Really? Growing up on a farm, and having friends/acquaintances who were either organic or interested in going organic, I don't recall that pesticides and herbicides were allowed. The so-called "organic pesticides" and "organic herbicides" I've seen are mostly just all natural snake oil...

Here's the list of non-organic substances allowed by USDA [1] and hopefully it means more to you than it does to me.

[1] https://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&SID=06b088e611c...

Re: Vendors must start adding physical on/off switches to devices that can spy on us

#110

Post by tonyarkles » Sat, Apr 20, 2019, 11:05 PM UTC

close04 wrote: post #14

cobbzilla wrote: post #5

Earlier quoted context omitted.

Hopefully this would easily be detected, and the brand damage from the resultant public shaming should be enough of a deterrent. But maybe it's really well hidden and eludes detection, or people just don't care and there is no brand damage, or maybe even there's no "real" brand to damage (OEM crapware).

I’d imagine a vendor bothering to put an off switch will know that a simple teardown will show if it actually disconnects the device or just signals software to do it. The effort and expense would be for nothing. Most users would never bother to care about the off switch anyway, and the ones that do will know the truth.

Eh, as someone else mentioned the soft switch, you could very easily make this teardown resistant by putting the covert power rail on an inner layer of the pcb with the switching transistor out of the way connected to vias. It’s not teardown-proof, but wouldn’t be obvious with a trivial inspection.