Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Camera and microphone require HTTPS in Firefox 68

blog.mozilla.org

Post reply on HN
Print view View original

101–110 of 215 posts

Re: Camera and microphone require HTTPS in Firefox 68

#101

Post by outworlder »

asdfasgasdgasdg wrote: post #96
packet_nerd wrote: post #56

Earlier quoted context omitted.

A quick search seems to turn up quite a few examples of webcam spying. I'd love to see actual numbers, but it doesn't seem to be "incredibly rare". https://www.dailymail.co.uk/sciencetech/article-5228017/Hack... https://www.dailymail.co.uk/news/article-2638874/More-90-peo... https://globalnews.ca/news/2158281/what-you-need-to-know-abo... https://www.telegraph.co.uk/technology/news/10131456/Hackers... This site claims…

OK. That has caused me to update my beliefs. I still think that there is relatively little risk -- like, you should be much more worried about being in a car accident -- but I no longer think it's on par with being struck by lightning.

Why would this be of little risk? The good thing about software is that it is automatable. That's also the bad thing.

Create a malware (which due to some big company fuckups can be even embedded in a webpage these days). Capture frames indiscriminately. Add some image recognition algorithms (from OCR to machine learning, depending on what you want to do) to flag interesting hits.

Voila. Massive dragnet. Applications can range from simple blackmail (a-la Black Mirror) to industrial espionage.

Re: Camera and microphone require HTTPS in Firefox 68

#102

Post by anyfoo »

rxhernandez wrote: post #41
Wowfunhappy wrote: post #38

Earlier quoted context omitted.

This is a better solution overall, as it's "by default". A hardware switch relies on the user to be privacy conscious. An LED which is physically connected to the camera circuit (!) is immediately noticeable if it turns on unexpectedly.

As a layperson in this arena, I'm skeptical as to whether it's a great solution. Is it possible to turn the camera on and off very quickly? If so, a smart hacker could do that really quickly and if the owner ever notices they would probably think there is a problem with the electrical rather than thinking they are being monitored.

How long did it take you, a self-proclaimed layperson, to come up with the idea of quickly pulsing the camera? Now, how likely do you think it is that someone who's actively trying to prevent camera shenanigans would think of this idea as well, and mitigate by e.g. introduce delays or latch the light on for a couple of seconds?

Re: Camera and microphone require HTTPS in Firefox 68

#103

Post by _fzslm »

mort96 wrote: post #91
varenc wrote: post #23

Earlier quoted context omitted.

For local development, Chrome has a flag that lets you force specific origins to be treated as secure: chrome://flags/#unsafely-treat-insecure-origin-as-secure I don't think Firefox has anything equivalent though? This bug on the topic is unassigned: https://bugzilla.mozilla.org/show_bug.cgi?id=1410365

I don't imagine that works on mobile chrome, which is what the parent comment was talking about.

It does, on Android.

Re: Camera and microphone require HTTPS in Firefox 68

#106

Post by chipperyman573 »

lucb1e wrote: post #24
klodolph wrote: post #14

Earlier quoted context omitted.

iptables on your phone? I think you would need to root your phone, if it's Android.

I think it's not unreasonable for a techie to be the admin of their own phone. (I still don't get how this is an unpopular opinion.)

If you have a OnePlus (which come more or less rooted) or a Samsung (Which has a lot of community support), you can probably root it pretty easily. But a lot of other phones lack the manufacturer's blessing or the community's support, leaving you SOL unless you can find an exploit yourself.

Also... iphone?

Re: Camera and microphone require HTTPS in Firefox 68

#107

Post by justinclift »

Wowfunhappy wrote: post #38
atonse wrote: post #9

Earlier quoted context omitted.

From my understanding, Apple has done sort of what you're asking for, they've hooked up the physical wiring of the camera LED to the camera itself, so it is physically impossible to power the camera without the LED being turned on (as opposed to the "turn on LED" being part of firmware logic that could be hacked).

This is a better solution overall, as it's "by default". A hardware switch relies on the user to be privacy conscious. An LED which is physically connected to the camera circuit (!) is immediately noticeable if it turns on unexpectedly.

Doesn't really cover situations where the computer is in a persons bedroom (common with eg: teenagers), and not powered off overnight.

Re: Camera and microphone require HTTPS in Firefox 68

#108

Post by yeukhon »

mort96 wrote: post #93
hannob wrote: post #50

Earlier quoted context omitted.

> It would be nice if it also worked on local IPs, like 192.168... That would defeat the security purpose. Anyone within your local network (which practically speaking very often means the next Wifi your device could find) could attack you.

But how do you do local development when you can't get an SSL cert for your dev machine's server? No, self signed certs don't always do what you need, especially on mobile where you can't just add your cert as a trusted cert easily.

I know localhost is supported by Lets Encrypt but not sure about local lan network. One possible workaround is ssh forwarding. Create a tunnel. But I have not tried it myself.

Re: Camera and microphone require HTTPS in Firefox 68

#109

Post by meruru »

hereme888 wrote: post #11
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

That's what the Purism laptops have. But they're linux-based (although I hear Mac OS is based on linux kernel).

The Pinebook too.

Re: Camera and microphone require HTTPS in Firefox 68

#110

Post by meruru »

LeoPanthera wrote: post #7
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

Have you noticed that the people who tape up their laptop camera almost always still carry around a smartphone in their pocket 100% of the time.

I tape my phone cameras too.
Post reply on HN