Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wyze security incident update

forums.wyze.com

Post reply on HN
Print view View original

121–130 of 161 posts

Re: Wyze security incident update

#121

Post by Cheer2171 »

voakbasda wrote: post #75

Another in a long line of reasons to avoid low price, off-the-shelf, unauditable, cloud-enabled cameras. I continue to be amazed that there is not a reasonably priced, open source, audited, local-first solution, which doesn’t require a significant personal investment of time to install and maintain.

I swear sometimes you people post this ignorance bait to get product suggestions.

Local-first cameras are super cheap and easy to find. Most just run their own local RTSP server, which you can connect to live with VLC, homeassistant, whatever. OpenIPC is like ddwrt for ip cameras, here is the supported devices page: https://github.com/OpenIPC/wiki/blob/master/en/guide-support...

But unless you're Richard Stallman, go with the closed source Reolink RTSP camera, which is about $100 and used by big corporate installs. It can integrate with the cloud, but you can set it up to just have each camera run a RTSP server with user/pass auth. You have to secure your own network.

But there isn't a really great open source platform for the kind of multi cam security that businesses might need. You have to do your own storage. But grab four reolinks, send the feeds to homeassistant, and most homeowners will be fine.

Re: Wyze security incident update

#122

Post by NegativeK »

albert_e wrote: post #50
creativeSlumber wrote: post #44

>The outage originated from our partner AWS and took down Wyze devices for several hours early Friday morning. ... As we worked to bring cameras back online, we experienced a security issue. Some users reported seeing the wrong thumbnails and Event Videos in their Events tab. ... The incident was caused by a third-party caching client library that was recently integrated into our system. This client library received…

Lot of blaming others - for architecture, stack, configuration, and operational choices that are likey/should be own decisions that should come with taking ownership.

But they've built dashboards! They probably even bought products with a single pane of glass!

Re: Wyze security incident update

#124

Post by yukkuri »

Cheer2171 wrote: post #69
prmoustache wrote: post #48

Earlier quoted context omitted.

Why would your insurance require a proof of the theft? That is not how insurances work usually.

My home insurance requires proof of theft. Often you use a police report. My local police department is on an unofficial slowdown strike because they don't feel appreciated post-BLM. Possibly also because if they "forget" to file police reports or they "get lost in the system" then the official crime rate goes down. It took me over a month to get a police report I could send to insurance for a simple break in, and sp…

Doing a "job action" like that because people have lost trust in your profession isn't going to restore that trust.

The only thing that will is to stop being trigger happy menaces to public safety.

Re: Wyze security incident update

#125

Post by UberFly »

Cheer2171 wrote: post #121
voakbasda wrote: post #75

Another in a long line of reasons to avoid low price, off-the-shelf, unauditable, cloud-enabled cameras. I continue to be amazed that there is not a reasonably priced, open source, audited, local-first solution, which doesn’t require a significant personal investment of time to install and maintain.

I swear sometimes you people post this ignorance bait to get product suggestions. Local-first cameras are super cheap and easy to find. Most just run their own local RTSP server, which you can connect to live with VLC, homeassistant, whatever. OpenIPC is like ddwrt for ip cameras, here is the supported devices page: https://github.com/OpenIPC/wiki/blob/master/en/guide-support... But unless you're Richard Stallman, go…

Was this response just to call others ignorant and then suggest your favorite brands?

Re: Wyze security incident update

#126

Post by thekevan »

jasongill wrote: post #3

> We’ve identified your Wyze account as one that was affected. This means that thumbnails from your Events were visible in another Wyze user’s account and that a thumbnail was tapped. Most taps enlarged the thumbnail, but in some cases it could have caused an Event Video to be viewed. Kudos to Wyze for doing the things noted in the thread like being honest and prompt with notification etc, but "thumbnails from your E…

"like being honest and prompt with notification etc,"

On the Wyze subreddit, people have been griping about the fact that it took them days to even acknowledge something happened. When I read the Wyze email about it, there was no new info in it, it had pretty much all already been discussed online.

Re: Wyze security incident update

#127

Post by twisteriffic »

achille wrote: post #78
twisteriffic wrote: post #2

> The incident was caused by a third-party caching client library that was recently integrated into our system. This client library received unprecedented load conditions caused by devices coming back online all at once. As a result of increased demand, it mixed up device ID and user ID mapping and connected some data to incorrect accounts. That seems like enough of a line of bullshit to steer me away from ever using…

Same thing happened to OpenAI. Will you steer clear of OpenAI forever as well? https://news.ycombinator.com/item?id=35294082

... Yes?

Re: Wyze security incident update

#128

Post by NelsonMinar »

voakbasda wrote: post #75

Another in a long line of reasons to avoid low price, off-the-shelf, unauditable, cloud-enabled cameras. I continue to be amazed that there is not a reasonably priced, open source, audited, local-first solution, which doesn’t require a significant personal investment of time to install and maintain.

I would really like a nice consumer friendly product that either didn't use cloud storage at all or if it did, had end to end encryption of the video.

I don't have time to mess around with hacking a camera to do RTSP and then figure out how to set up and use something unfriendly like ZoneMinder.

Re: Wyze security incident update

#130

Post by iAMkenough »

syntaxing wrote: post #19

This is one of the things Apple does right. HomeKit working local is a pretty great setup and just works. I put my HomeKit cameras on a VLAN without internet and device isolation and they still work seamlessly. The hard part is getting cameras that are wireless. I use scrypted but even then, getting ONVIF or RTSP isn’t as straight forward nowadays. I also have a local frigate backup which works great too. You can pip…

I'm looking forward to the day HomeKit supports 2K and/or 4K video recordings.
Post reply on HN