Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Camera and microphone require HTTPS in Firefox 68

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 215 posts

Re: Camera and microphone require HTTPS in Firefox 68

#41

Post by rxhernandez »

Wowfunhappy wrote: post #38
atonse wrote: post #9

Earlier quoted context omitted.

From my understanding, Apple has done sort of what you're asking for, they've hooked up the physical wiring of the camera LED to the camera itself, so it is physically impossible to power the camera without the LED being turned on (as opposed to the "turn on LED" being part of firmware logic that could be hacked).

This is a better solution overall, as it's "by default". A hardware switch relies on the user to be privacy conscious. An LED which is physically connected to the camera circuit (!) is immediately noticeable if it turns on unexpectedly.

As a layperson in this arena, I'm skeptical as to whether it's a great solution. Is it possible to turn the camera on and off very quickly? If so, a smart hacker could do that really quickly and if the owner ever notices they would probably think there is a problem with the electrical rather than thinking they are being monitored.

Re: Camera and microphone require HTTPS in Firefox 68

#42

Post by jedberg »

amelius wrote: post #40
ohazi wrote: post #13

Earlier quoted context omitted.

Mac OS is in no way based on the Linux kernel.

Perhaps it would be if the license was different.

Unlikely. The Apple kernel guys are purists and would probably use the BSD kernel even if Linux were MIT licensed.

Re: Camera and microphone require HTTPS in Firefox 68

#43

Post by layoutIfNeeded »

admax88q wrote: post #37
nothrabannosir wrote: post #16

Earlier quoted context omitted.

A smartphone is significantly more secure than a computer. I install lord knows what NPM package from God knows where on a weekly basis. Only since very recently does mic or camera access cause any kind of system prompt on Mac. Smartphones , for all their faults , at least are far less vulnerable to viruses than pcs. Or at least iOS vs Mac.

Your device is as secure as you make it. Why are you installing "lord knows what npm package" on your laptop?

>Why are you installing "lord knows what npm package" on your laptop?

Probably because he installs lord knows what npm packages to his production servers too.

Re: Camera and microphone require HTTPS in Firefox 68

#44

Post by arcticbull »

groovybits wrote: post #19
hereme888 wrote: post #11

Earlier quoted context omitted.

That's what the Purism laptops have. But they're linux-based (although I hear Mac OS is based on linux kernel).

Mac OS was originally based on BSD. https://en.wikipedia.org/wiki/Berkeley_Software_Distribution

The kernel is not BSD, it's based on the Mach microkernel [1] with a BSD compatibility layer implemented on top. The whole thing collectively is called XNU [2].

[1] https://en.wikipedia.org/wiki/Mach_(kernel)

[2] https://en.wikipedia.org/wiki/XNU

Re: Camera and microphone require HTTPS in Firefox 68

#47

Post by simcop2387 »

asdfasgasdgasdg wrote: post #36
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

I think I understand the risk, and I definitely would not bother with such a switch even were it available. So maybe I actually don't understand it. What exactly is the risk? Have there been any actual cases of someone being spied on with their laptop webcam that would have been prevented by a switch? I'm only aware of cases where the webcam switch would not have helped (e.g. roommate sets up notebook to record owner…

Here's a case that went to court about it,

https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School...

Re: Camera and microphone require HTTPS in Firefox 68

#48

Post by EGreg »

rxhernandez wrote: post #41
Wowfunhappy wrote: post #38

Earlier quoted context omitted.

This is a better solution overall, as it's "by default". A hardware switch relies on the user to be privacy conscious. An LED which is physically connected to the camera circuit (!) is immediately noticeable if it turns on unexpectedly.

As a layperson in this arena, I'm skeptical as to whether it's a great solution. Is it possible to turn the camera on and off very quickly? If so, a smart hacker could do that really quickly and if the owner ever notices they would probably think there is a problem with the electrical rather than thinking they are being monitored.

It is just like the small hacks that are possible with ANY of these “require UNRELATED user interaction” things.

Like being able to speak “” when the user clicks. Or something really short or kind of unpronounceable like “,,,,”. Apple could of course try to require the first speech to always be long enough to be unmistakably speech. But otherwise ANY user interaction is enough to enable ANY speech.

The alternative would he to have dialogs for everything: “would you like to turn on the camera?” “Would you like to let this website use speech to text?” “Always remember my choice for this domain”.

Seems giving the user a master switch that overrides things, and letting websites detect this and complain, doesnmr have many downsides but has tons of upsides.

And then of course there is browser fingerprinting. It’s now really hard to turn it off without breaking tons of sites that care about the width of your window (size of your phone) and your operating system, and so on

Re: Camera and microphone require HTTPS in Firefox 68

#49

Post by sangnoir »

rxhernandez wrote: post #41
Wowfunhappy wrote: post #38

Earlier quoted context omitted.

This is a better solution overall, as it's "by default". A hardware switch relies on the user to be privacy conscious. An LED which is physically connected to the camera circuit (!) is immediately noticeable if it turns on unexpectedly.

As a layperson in this arena, I'm skeptical as to whether it's a great solution. Is it possible to turn the camera on and off very quickly? If so, a smart hacker could do that really quickly and if the owner ever notices they would probably think there is a problem with the electrical rather than thinking they are being monitored.

LED brightness is controlled by pulse-width modulation: at low frequencies, the camera LED would appear dimly lit. A more sophisticated approach might be to combine gaze detection to ramp-down frequency if someone is looking towards the camera/LED.

Re: Camera and microphone require HTTPS in Firefox 68

#50

Post by hannob »

petters wrote: post #2

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168. . . Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.

> It would be nice if it also worked on local IPs, like 192.168...

That would defeat the security purpose.

Anyone within your local network (which practically speaking very often means the next Wifi your device could find) could attack you.

Post reply on HN