Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Camera and microphone require HTTPS in Firefox 68

blog.mozilla.org

Post reply on HN
Print view View original

61–70 of 215 posts

Re: Camera and microphone require HTTPS in Firefox 68

#61

Post by sethhochberg »

asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

If anyone is looking for a nice webcam cover for laptops, I've found the super-thin ones (marketed as "0.7mm thin" by EYSOFT and others on Amazon, etc) are fantastic. Very cheap, very thin, visually unobtrusive, and dead-simple to use. Doesn't interfere with closing my Macbook at all, it protrudes less than the rubber bumper around the screen border.

Still miss the physical mic mute button on my old Thinkpad X230... and it didn't have a webcam button for that, but we've _almost_ had all of the right features in the past...

Re: Camera and microphone require HTTPS in Firefox 68

#62

Post by zonidjan »

dark_glass wrote: post #57
asdfasgasdgasdg wrote: post #36

Earlier quoted context omitted.

I think I understand the risk, and I definitely would not bother with such a switch even were it available. So maybe I actually don't understand it. What exactly is the risk? Have there been any actual cases of someone being spied on with their laptop webcam that would have been prevented by a switch? I'm only aware of cases where the webcam switch would not have helped (e.g. roommate sets up notebook to record owner…

Here's a recent 0-day involving Macs and Zoom (or RingCentral): https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-milli...

Which is an exploit, not an attack.

Re: Camera and microphone require HTTPS in Firefox 68

#63

Post by kevin_thibedeau »

sangnoir wrote: post #49
rxhernandez wrote: post #41

Earlier quoted context omitted.

As a layperson in this arena, I'm skeptical as to whether it's a great solution. Is it possible to turn the camera on and off very quickly? If so, a smart hacker could do that really quickly and if the owner ever notices they would probably think there is a problem with the electrical rather than thinking they are being monitored.

LED brightness is controlled by pulse-width modulation: at low frequencies, the camera LED would appear dimly lit. A more sophisticated approach might be to combine gaze detection to ramp-down frequency if someone is looking towards the camera/LED.

A momentary flicker would not be perceptible in a lit room.

Re: Camera and microphone require HTTPS in Firefox 68

#64

Post by zonidjan »

asdfasgasdgasdg wrote: post #36
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

I think I understand the risk, and I definitely would not bother with such a switch even were it available. So maybe I actually don't understand it. What exactly is the risk? Have there been any actual cases of someone being spied on with their laptop webcam that would have been prevented by a switch? I'm only aware of cases where the webcam switch would not have helped (e.g. roommate sets up notebook to record owner…

Well, yeah. There's a reason why built-in webcam covers / physical switches are much more prevalent on laptops oriented towards business/government users (cf Thinkpads).

Re: Camera and microphone require HTTPS in Firefox 68

#65

Post by nothrabannosir »

admax88q wrote: post #52
layoutIfNeeded wrote: post #43

Earlier quoted context omitted.

>Why are you installing "lord knows what npm package" on your laptop? Probably because he installs lord knows what npm packages to his production servers too.

I don't get why people who even admit that they dont trust these random npm packages can think its okay to ship them in production and put all their user's data at risk. It's malpractice.

I’d love to know a metric of trust and its relation to customer data. How many trust points for how much PII? I’m assuming it’s a logarithmic scale? And a Debian stable package gets , what, double the points of an npm package? Or I guess it depends on the weekly downloads? What about pip, gems, vim plugins, emacs packages (I’m looking at you melpa) , quicklisp, ...

Then we can play an honest thought experiment: how many people satisfy that metric? Don’t forget to correct for actually how much PII points one is handling.

If you don’t at least have some consideration of those factors, claiming malpractice seems fatuous.

Re: Camera and microphone require HTTPS in Firefox 68

#67

Post by zonidjan »

arcticbull wrote: post #44
groovybits wrote: post #19

Earlier quoted context omitted.

Mac OS was originally based on BSD. https://en.wikipedia.org/wiki/Berkeley_Software_Distribution

The kernel is not BSD, it's based on the Mach microkernel [1] with a BSD compatibility layer implemented on top. The whole thing collectively is called XNU [2]. [1] https://en.wikipedia.org/wiki/Mach_(kernel) [2] https://en.wikipedia.org/wiki/XNU

It was developed from something that was based on Mach. However, it is also based on BSD, as your second link states.

> The BSD code present in XNU came from the FreeBSD kernel. Although much of it has been significantly modified, code sharing still occurs between Apple and the FreeBSD Project.

Re: Camera and microphone require HTTPS in Firefox 68

#68

Post by zonidjan »

LeoPanthera wrote: post #7
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

Have you noticed that the people who tape up their laptop camera almost always still carry around a smartphone in their pocket 100% of the time.

Can my smartphone see anything from inside my pocket?

Re: Camera and microphone require HTTPS in Firefox 68

#69

Post by [deleted] »

zonidjan wrote: post #67
arcticbull wrote: post #44

Earlier quoted context omitted.

The kernel is not BSD, it's based on the Mach microkernel [1] with a BSD compatibility layer implemented on top. The whole thing collectively is called XNU [2]. [1] https://en.wikipedia.org/wiki/Mach_(kernel) [2] https://en.wikipedia.org/wiki/XNU

It was developed from something that was based on Mach. However, it is also based on BSD, as your second link states. > The BSD code present in XNU came from the FreeBSD kernel. Although much of it has been significantly modified, code sharing still occurs between Apple and the FreeBSD Project.

[deleted]

Re: Camera and microphone require HTTPS in Firefox 68

#70

Post by kickopotomus »

sangnoir wrote: post #49
rxhernandez wrote: post #41

Earlier quoted context omitted.

As a layperson in this arena, I'm skeptical as to whether it's a great solution. Is it possible to turn the camera on and off very quickly? If so, a smart hacker could do that really quickly and if the owner ever notices they would probably think there is a problem with the electrical rather than thinking they are being monitored.

LED brightness is controlled by pulse-width modulation: at low frequencies, the camera LED would appear dimly lit. A more sophisticated approach might be to combine gaze detection to ramp-down frequency if someone is looking towards the camera/LED.

PWM reduces average power. If the LED is on the same circuit as the camera, I don't know how successful you will be at powering the camera while trying to dim the LED.
Post reply on HN