Live data from Hacker News

Camera and microphone require HTTPS in Firefox 68

blog.mozilla.org

51–60 of 215 posts

Re: Camera and microphone require HTTPS in Firefox 68

#51
post #24

Earlier quoted context omitted.

iptables on your phone? I think you would need to root your phone, if it's Android.

I think it's not unreasonable for a techie to be the admin of their own phone. (I still don't get how this is an unpopular opinion.)

> (I still don't get how this is an unpopular opinion.)

Not unpopular, just unrealistic. You can't do it on an iPhone, and if you're doing local web development you really ought to be checking it on an iPhone.

Re: Camera and microphone require HTTPS in Firefox 68

#52

Earlier quoted context omitted.

Your device is as secure as you make it. Why are you installing "lord knows what npm package" on your laptop?

>Why are you installing "lord knows what npm package" on your laptop? Probably because he installs lord knows what npm packages to his production servers too.

I don't get why people who even admit that they dont trust these random npm packages can think its okay to ship them in production and put all their user's data at risk. It's malpractice.

Re: Camera and microphone require HTTPS in Firefox 68

#54
post #9

Earlier quoted context omitted.

From my understanding, Apple has done sort of what you're asking for, they've hooked up the physical wiring of the camera LED to the camera itself, so it is physically impossible to power the camera without the LED being turned on (as opposed to the "turn on LED" being part of firmware logic that could be hacked).

FWIW... I bet you could power the camera, get a still frame at 60fps, shut it down, and not see the led come on. It would be 1/60, 16ms plus or minus the amount of overhead needed, plus autofocus and exposure correction might make it impractical, but it’s definitely not a bulletproof fix.

Apple could simply make the camera take 1 second to activate.

Re: Camera and microphone require HTTPS in Firefox 68

#55
post #26

This page's content is in a div named "mobile-pusher" with a 400px padding-right, which then gets disabled when loading a JS script from a third-party domain (ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com). wtf?

probably related to the hamburger menu on mobile, which pushes that div over 300px

Re: Camera and microphone require HTTPS in Firefox 68

#56
post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

I think I understand the risk, and I definitely would not bother with such a switch even were it available. So maybe I actually don't understand it. What exactly is the risk? Have there been any actual cases of someone being spied on with their laptop webcam that would have been prevented by a switch? I'm only aware of cases where the webcam switch would not have helped (e.g. roommate sets up notebook to record owner…

A quick search seems to turn up quite a few examples of webcam spying. I'd love to see actual numbers, but it doesn't seem to be "incredibly rare".

https://www.dailymail.co.uk/sciencetech/article-5228017/Hack...

https://www.dailymail.co.uk/news/article-2638874/More-90-peo...

https://globalnews.ca/news/2158281/what-you-need-to-know-abo...

https://www.telegraph.co.uk/technology/news/10131456/Hackers...

This site claims a guy made a business selling software to hack and remotely control webcams, complete with paid employees and $350,000 in income:

https://www.welivesecurity.com/2015/04/21/webcam-hacking/

Re: Camera and microphone require HTTPS in Firefox 68

#57
post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

I think I understand the risk, and I definitely would not bother with such a switch even were it available. So maybe I actually don't understand it. What exactly is the risk? Have there been any actual cases of someone being spied on with their laptop webcam that would have been prevented by a switch? I'm only aware of cases where the webcam switch would not have helped (e.g. roommate sets up notebook to record owner…

Here's a recent 0-day involving Macs and Zoom (or RingCentral): https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-milli...

Re: Camera and microphone require HTTPS in Firefox 68

#58
post #9

Earlier quoted context omitted.

From my understanding, Apple has done sort of what you're asking for, they've hooked up the physical wiring of the camera LED to the camera itself, so it is physically impossible to power the camera without the LED being turned on (as opposed to the "turn on LED" being part of firmware logic that could be hacked).

That's useful, but it's not as reassuring as a hardware switch where you can see it work. (For video, anyway. I don't see any similar solution for audio.)

Two reasons why switch is better:

1. If it does happen to light up, what would you do, turn off your computer? That's shitty.

2. What if your AFK and aren't looking at the light?

Re: Camera and microphone require HTTPS in Firefox 68

#59
post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

I think I understand the risk, and I definitely would not bother with such a switch even were it available. So maybe I actually don't understand it. What exactly is the risk? Have there been any actual cases of someone being spied on with their laptop webcam that would have been prevented by a switch? I'm only aware of cases where the webcam switch would not have helped (e.g. roommate sets up notebook to record owner…

It's more or less a feeling. Because if someone can activate your camera without you knowing you have bigger problems.

Re: Camera and microphone require HTTPS in Firefox 68

#60
post #10

Earlier quoted context omitted.

The difference being that the smartphone camera isn't pointed at your face or room the entire time the device is in use.

Frankly I don't think it's the camera that people should be most concerned about - it's the microphone.

Why?
Post reply on HN