Live data from Hacker News

CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

troyhunt.com

171–175 of 175 posts

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#171

Earlier quoted context omitted.

Computer/network security will never be important until governments start regulating this stuff through specialized agencies. It's the opposite of profitable to care, so businesses who do care are disadvantaged.

> Computer/network security will never be important until governments start regulating this stuff through specialized agencies. Well I wouldn't say never, just needs some people determined to have it on the core of the team. Certs are free to low cost depending on the type you want. Compute needed for "Security" is minimal (Heck we can even do RootCA Validation on the the ESP8266 these days). But this isn't directly…

>How much profit does it cut to not to put your mongoDB instance internet facing?

Wrong question. How much profit does it cut to hire an engineer who knows not to make your mongoDB instance Internet-facing and to empower that engineer enough that they can tell the CEO that the product is not ready to launch and they can't just open public access to the develop/test environment is the question. And it's not even a matter of profit. It's a matter of pride. Engineers are seen as typists and nerds, low level functionaries. They're the ones who don't understand the divine wisdom of "don't let the perfect be the enemy of the good enough."

You wonder why companies are so stupendously desperate for H1B visas and why so many job listings are looking for 2 years experience and no more? It's because they don't WANT knowledgeable staff. Those tend to be expensive, and problematic.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#172
post #84
post #82

Earlier quoted context omitted.

Meanwhile police in a murder case are preparing to take Amazon to court for Echo records. On the privacy front, there's just no saving people, but the IoT brings the magic of invading privacy together with furnishing botnets with millions of new bots! We're screwed coming and going, and the vast majority still look at you like a woodland hermit if you suggest that you shouldn't have anything listening to you in your…

I wonder how much infrastructure is really required to properly support Alexa like capabilities for an individual. Does Amazon really need all of our recordings on their hardware in their data centers? Is it conceivable that we could own that hardware as well? I realize that training data is important and I assume the recorded data gets used for that purpose but does Amazon need to keep it forever? How long do they n…

It requires almost nothing. The training process requires large amounts of test data. But once the system is trained, the actual set of weights needed is tiny and running the recognition itself is cake. The whole reason all voice recognition is server-based is purely for business reasons, to lock people into their service, to provide new sources of consumer data to mine and sell, etc.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#173
post #78
post #69

> The Germans had a good point: kids' toys which record their voices and send the recordings up to the web pose some serious privacy risks. It's not that the risks are particularly any different to the ones you and I face every day with the volumes of data we produce and place online (and if you merely have a modern phone, that's precisely what you're doing), it's that our tolerances are very different when kids are…

First, it's not just about "get [them] in trouble". Think about ten years later. Do we want adversaries to have logs of children's conversations? Also, It's not just recordings. Once an adversary has account access, they can talk to children. I can't imagine that being a good thing.

People kept devices which allowed strangers to talk to their children sitting in their house, often in the children's bedroom for nearly a century and it wasn't a major problem. The vast majority of child abuse (like 95+%) is committed by parents or close family members. The danger of strangers is overblown and you shouldn't have to harp on that to get people concerned about companies unnecessarily snarfing up every bit of data about everyone of every age.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#174
post #61

Earlier quoted context omitted.

Seriously? That's a fairly aggressive comment to just throw out there without any backing arguments. You really can't think of anything valuable about hooking up small devices/sensors to the internet? Do you really believe the potential for stronger security is so low that it's not worth investigating? I work at an IoT company and we take security far more seriously than some would say is necessary or even reasonable…

But I do hear that self driving car has no idea to look for the traffic light if it was not informed beforehand it is here. That does not bring any confidence. Also, I still don't know what problem is IoT supposed to solve.

Step onto a refinery and watch workers physically check gauges every day in a relatively dangerous environment.

Oil fields, someone drives out every day in a pickup, checks gauges.

Etc.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#175
post #133

Earlier quoted context omitted.

It doesn't help the server side data leak but at least you can't connect to it and make it say 'destroy all humans'

That's not necessarily the case. TLS protects the connection, but by default does not provide authentication. I also see a lot of instances where certificate checking has been disabled, so that the client just ignores a MitM attack. So with TLS it would seem more secure at first glance, but given the implementation blunders here I wouldn't expect any real improvement.

Yeah that's true, I'm totally assuming 'competently implemented TLS' when I say it would protect the connection.
Post reply on HN