Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Camera and microphone require HTTPS in Firefox 68

blog.mozilla.org

Post reply on HN
Print view View original

31–40 of 215 posts

Re: Camera and microphone require HTTPS in Firefox 68

#31

Post by Nextgrid »

asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

If an attacker can access your webcam/microphone at will this means they can run arbitrary code to capture your screen, display anything you want and capture your keystrokes.

In this case the camera or microphone is the least of your worries.

Re: Camera and microphone require HTTPS in Firefox 68

#33

Post by Nextgrid »

XCSme wrote: post #30
atonse wrote: post #9

Earlier quoted context omitted.

From my understanding, Apple has done sort of what you're asking for, they've hooked up the physical wiring of the camera LED to the camera itself, so it is physically impossible to power the camera without the LED being turned on (as opposed to the "turn on LED" being part of firmware logic that could be hacked).

I remember there was a story saying that it's possible, via software only (due to a "bug" and some "poor" hardware design), to turn on the camera without activating the LED.

It used to be that the LED was controlled by firmware. As far as I know this is fixed now but I haven't proven it myself.

There are leaked schematics of MacBooks online (that unofficial repair shops use) so if you want to investigate this I'd expect it to be a good place to start.

Re: Camera and microphone require HTTPS in Firefox 68

#34

Post by SlowRobotAhead »

atonse wrote: post #9
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

From my understanding, Apple has done sort of what you're asking for, they've hooked up the physical wiring of the camera LED to the camera itself, so it is physically impossible to power the camera without the LED being turned on (as opposed to the "turn on LED" being part of firmware logic that could be hacked).

FWIW... I bet you could power the camera, get a still frame at 60fps, shut it down, and not see the led come on. It would be 1/60, 16ms plus or minus the amount of overhead needed, plus autofocus and exposure correction might make it impractical, but it’s definitely not a bulletproof fix.

Re: Camera and microphone require HTTPS in Firefox 68

#35

Post by css »

XCSme wrote: post #30
atonse wrote: post #9

Earlier quoted context omitted.

From my understanding, Apple has done sort of what you're asking for, they've hooked up the physical wiring of the camera LED to the camera itself, so it is physically impossible to power the camera without the LED being turned on (as opposed to the "turn on LED" being part of firmware logic that could be hacked).

I remember there was a story saying that it's possible, via software only (due to a "bug" and some "poor" hardware design), to turn on the camera without activating the LED.

https://jscholarship.library.jhu.edu/handle/1774.2/36569 (2013)

Re: Camera and microphone require HTTPS in Firefox 68

#36

Post by asdfasgasdgasdg »

asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

I think I understand the risk, and I definitely would not bother with such a switch even were it available. So maybe I actually don't understand it.

What exactly is the risk? Have there been any actual cases of someone being spied on with their laptop webcam that would have been prevented by a switch? I'm only aware of cases where the webcam switch would not have helped (e.g. roommate sets up notebook to record owner naked). Even that is incredibly rare, or if not rare, almost never reported.

Re: Camera and microphone require HTTPS in Firefox 68

#37

Post by admax88q »

nothrabannosir wrote: post #16
LeoPanthera wrote: post #7

Earlier quoted context omitted.

Have you noticed that the people who tape up their laptop camera almost always still carry around a smartphone in their pocket 100% of the time.

A smartphone is significantly more secure than a computer. I install lord knows what NPM package from God knows where on a weekly basis. Only since very recently does mic or camera access cause any kind of system prompt on Mac. Smartphones , for all their faults , at least are far less vulnerable to viruses than pcs. Or at least iOS vs Mac.

Your device is as secure as you make it. Why are you installing "lord knows what npm package" on your laptop?

Re: Camera and microphone require HTTPS in Firefox 68

#38

Post by Wowfunhappy »

atonse wrote: post #9
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

From my understanding, Apple has done sort of what you're asking for, they've hooked up the physical wiring of the camera LED to the camera itself, so it is physically impossible to power the camera without the LED being turned on (as opposed to the "turn on LED" being part of firmware logic that could be hacked).

This is a better solution overall, as it's "by default". A hardware switch relies on the user to be privacy conscious. An LED which is physically connected to the camera circuit (!) is immediately noticeable if it turns on unexpectedly.

Re: Camera and microphone require HTTPS in Firefox 68

#39

Post by klodolph »

lucb1e wrote: post #24
klodolph wrote: post #14

Earlier quoted context omitted.

iptables on your phone? I think you would need to root your phone, if it's Android.

I think it's not unreasonable for a techie to be the admin of their own phone. (I still don't get how this is an unpopular opinion.)

I also think it’s not unreasonable to not want to have root access to your phone.

Re: Camera and microphone require HTTPS in Firefox 68

#40

Post by amelius »

ohazi wrote: post #13
hereme888 wrote: post #11

Earlier quoted context omitted.

That's what the Purism laptops have. But they're linux-based (although I hear Mac OS is based on linux kernel).

Mac OS is in no way based on the Linux kernel.

Perhaps it would be if the license was different.
Post reply on HN