Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ring fired employees for watching customer videos

vice.com

Post reply on HN
Print view View original

121–130 of 147 posts

Re: Ring fired employees for watching customer videos

#121

Post by godelski »

chrisballinger wrote: post #6

Whenever end-to-end encryption is not used, scenarios like these are bound to happen eventually. As far as I know, the only home surveillance products that use E2EE are ones that support HomeKit Secure Video [1]. 1. https://support.apple.com/en-us/HT210538

Unless I COMPLETELY misunderstand encryption, E2E encryption only protects your data in transit. It does not mean that data on servers are encrypted NOR does it mean that servers don't have decryption keys to that data if it is encrypted.

Am I wrong about this?

Re: Ring fired employees for watching customer videos

#122

Post by nerdjon »

godelski wrote: post #121
chrisballinger wrote: post #6

Whenever end-to-end encryption is not used, scenarios like these are bound to happen eventually. As far as I know, the only home surveillance products that use E2EE are ones that support HomeKit Secure Video [1]. 1. https://support.apple.com/en-us/HT210538

Unless I COMPLETELY misunderstand encryption, E2E encryption only protects your data in transit. It does not mean that data on servers are encrypted NOR does it mean that servers don't have decryption keys to that data if it is encrypted. Am I wrong about this?

At least in Apple's case, they do not have the keys because it is encrypted by your devices and then uploaded. It is then only able to be read by your devices because they have the keys to un-encrypt it.

Re: Ring fired employees for watching customer videos

#123

Post by just_myles »

izacus wrote: post #15
chrisballinger wrote: post #6

Whenever end-to-end encryption is not used, scenarios like these are bound to happen eventually. As far as I know, the only home surveillance products that use E2EE are ones that support HomeKit Secure Video [1]. 1. https://support.apple.com/en-us/HT210538

These kind of scenarios can happen with workers in government offices, archives and medical institutions as well. And yet the paper documents are not E2E encrypted. Maybe... just maybe... technology is not really what should be the core issue here? But we should perhaps look at our policies and legislation? Adding proper liability there will make technology come by itself. The magic of free market doesn't seem to be…

I agree, there should be a legislative intervention here. These devices come out semi-regularly with no regard to security.

Re: Ring fired employees for watching customer videos

#124

Post by orclev »

godelski wrote: post #121
chrisballinger wrote: post #6

Whenever end-to-end encryption is not used, scenarios like these are bound to happen eventually. As far as I know, the only home surveillance products that use E2EE are ones that support HomeKit Secure Video [1]. 1. https://support.apple.com/en-us/HT210538

Unless I COMPLETELY misunderstand encryption, E2E encryption only protects your data in transit. It does not mean that data on servers are encrypted NOR does it mean that servers don't have decryption keys to that data if it is encrypted. Am I wrong about this?

Your confusion is around where the end is in this case. E2E would be encryption from the ring device to your other device being used to view the feed (your cellphone for instance). Part of the difficulty in that case is getting the encryption key securely transferred between the two devices without exposing it to anyone else (a non-trivial problem). Assuming that was done in this case Ring employees would only have access to the encrypted videos with no access to the decryption keys to actually view them.

E2E Encryption is usually referenced in messaging applications where the ends are understood to be the two communicating parties, while in this scenario it's a little more nebulous.

Re: Ring fired employees for watching customer videos

#125

Post by JohnFen »

Kocrachon wrote: post #118
JohnFen wrote: post #60

Earlier quoted context omitted.

> What is my recourse for preventing my private property from being recorded? Either put up a visual barrier or move. This sort of thing is why I consider products like Ring to be terrible and highly antisocial. I would avoid even going into a neighborhood that had many of these installed, let alone live in one. Also, am I the only one who thinks that the prevalence of these devices in a neighborhood is a very strong…

What's the big deal if it's ring, or me with a bunch of chinese-made POE cameras and blue iris as a local server? shouldn't people have the right to set up surveillance on their own house for protection and deterrence? saying people are paranoid for having cameras is ridiculous, people also have security systems. It's a deterrent and doesn't necessarily mean high crime. if you live in Major City like I have my whole…

> What's the big deal if it's ring, or me with a bunch of chinese-made POE cameras and blue iris as a local server?

If it's just you with a local server, then I only have to worry about you. If it's going to someone else's server, then I have to worry about them as well. And in the case of Ring specifically, that someone else is Amazon -- which is even more concerning.

> shouldn't people have the right to set up surveillance on their own house for protection and deterrence?

Sure, I never said otherwise. I have a surveillance system myself (on my own local servers), but I take great pains to ensure that no cameras are capturing anything that isn't my property.

> It's a deterrent and doesn't necessarily mean high crime.

I never said that it automatically means a high crime area. It's just highly suggestive of it. If it's a low crime area, far fewer people would feel the need for this sort of thing.

> if you live in Major City like I have my whole life, it's just a fact of life that you're going to want stuff like this.

No, it's not. I've lived in a number of major cities, and have never felt the need to point cameras at my neighbor's houses or the street.

Re: Ring fired employees for watching customer videos

#126

Post by nicoburns »

hinkley wrote: post #102
michaelmrose wrote: post #83

Earlier quoted context omitted.

Forget the analogies having to explicitly misuse the system to violate customers privacy creates a strong disincentive. All accesses to customers data should require multiple people not by policy but by mandatory access controls. The fact that employees could hack their employer is true and not meaningful. The number willing to commit felonies is less than the number willing to risk termination.

I feel like I asked this before and then didn't bookmark the answers. What systems are out there for requiring consensus for access? I know about K of N protocols for hardware cryptography, but I'm fuzzy on such systems for, say, admin functionality or data retrieval. Are they all in-house at this point? I've found over and over again in my work that it's much easier to spout rhetoric about process change when I have…

I can't remember which company it was, but I once read an article about a company who implemented their own version of `sudo`. Their version required another developer to approve your session before granting root privileges, and then allowed them to watch everything you did.

Re: Ring fired employees for watching customer videos

#127

Post by ryukafalz »

shadowgovt wrote: post #75
ryukafalz wrote: post #70

Earlier quoted context omitted.

Typically, at least in the US, a locked door can be opened from the inside without a key for that reason.

So while that is true (and not to go too far off into the weeds on an analogy), in an emergency, people are trying to follow procedure under pressure and the odds of error in operation of an interface increase. You want the interface that is used in an emergency situation to either be well practiced or absolutely as intuitive as possible. To destructure the analogy and give a concrete example, if I'm dying of allergi…

True, but:

- If you normally keep the door locked, unlocking it with the thumb turn is what you do every time anyway

- In cases where there are many people expected to use doors that they're unfamiliar with, it's typically even simpler to exit (panic bar on business fire exits, automatically-unlocking deadbolt on hotel doors, etc)

Re: Ring fired employees for watching customer videos

#128

Post by Wheaties466 »

chrisballinger wrote: post #6

Whenever end-to-end encryption is not used, scenarios like these are bound to happen eventually. As far as I know, the only home surveillance products that use E2EE are ones that support HomeKit Secure Video [1]. 1. https://support.apple.com/en-us/HT210538

The only product currently out that supports this is the logitech Circle.

https://www.apple.com/ios/home/accessories/#section-camera

Re: Ring fired employees for watching customer videos

#129

Post by smolder »

godelski wrote: post #121
chrisballinger wrote: post #6

Whenever end-to-end encryption is not used, scenarios like these are bound to happen eventually. As far as I know, the only home surveillance products that use E2EE are ones that support HomeKit Secure Video [1]. 1. https://support.apple.com/en-us/HT210538

Unless I COMPLETELY misunderstand encryption, E2E encryption only protects your data in transit. It does not mean that data on servers are encrypted NOR does it mean that servers don't have decryption keys to that data if it is encrypted. Am I wrong about this?

In short, yes, because end-to-end implies only a single producer and consumer have access to the data. Storage in the cloud wouldn't be an "end", and therefore it must be encrypted at that stage. The ends are 1) where the data is created by the device, and 2) wherever it is viewed on retrieval by the end user. While it's in the cloud it's still "in transit".

Facebook, if I recall correctly, at one point seemed to be trying to redefine the term to be "encrypted on its way to us and then back out again", which IMO is nothing short of propagandizing to confuse people, I assume to foil demand for real E2E encrypted products and gain unearned trust.

Re: Ring fired employees for watching customer videos

#130

Post by Wheaties466 »

Darkphibre wrote: post #51

What's a good cloudless setup? I've got a couple zwave devices, and have been looking into OpenHab. Win10 compatibility would be a bonus, as well as the ability to run my own OpenCV video analysis and voice recognition stacks...

Unifi Has a completely cloudless setup.

https://unifi-protect.ui.com/

Post reply on HN