Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Camera and microphone require HTTPS in Firefox 68

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 215 posts

Re: Camera and microphone require HTTPS in Firefox 68

#71

Post by jacobush »

rxhernandez wrote: post #41
Wowfunhappy wrote: post #38

Earlier quoted context omitted.

This is a better solution overall, as it's "by default". A hardware switch relies on the user to be privacy conscious. An LED which is physically connected to the camera circuit (!) is immediately noticeable if it turns on unexpectedly.

As a layperson in this arena, I'm skeptical as to whether it's a great solution. Is it possible to turn the camera on and off very quickly? If so, a smart hacker could do that really quickly and if the owner ever notices they would probably think there is a problem with the electrical rather than thinking they are being monitored.

It's a USB camera. It needs more time than a flicker to turn on and start producing frames. I don't think you could do as you said and still have the camera both work and the LED be dim.

Re: Camera and microphone require HTTPS in Firefox 68

#72

Post by seandougall »

rxhernandez wrote: post #41
Wowfunhappy wrote: post #38

Earlier quoted context omitted.

This is a better solution overall, as it's "by default". A hardware switch relies on the user to be privacy conscious. An LED which is physically connected to the camera circuit (!) is immediately noticeable if it turns on unexpectedly.

As a layperson in this arena, I'm skeptical as to whether it's a great solution. Is it possible to turn the camera on and off very quickly? If so, a smart hacker could do that really quickly and if the owner ever notices they would probably think there is a problem with the electrical rather than thinking they are being monitored.

> Is it possible to turn the camera on and off very quickly?

Not particularly. At least on my 2015 rMBP, using code that I wrote (so I know it's not doing anything extraneous), the light is on for about a quarter of a second before the first frame is returned from the camera. This is because the LED is literally showing you when the camera has power (which includes any sort of handshake with the system), not just when it's capturing frames.

Is that enough that a user who's really concentrating on the screen will nonetheless see the light come on? Not necessarily. But GP has a good point about this being a feature that doesn't rely on the user being proactive.

Re: Camera and microphone require HTTPS in Firefox 68

#73

Post by kraig »

sethhochberg wrote: post #61
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

If anyone is looking for a nice webcam cover for laptops, I've found the super-thin ones (marketed as "0.7mm thin" by EYSOFT and others on Amazon, etc) are fantastic. Very cheap, very thin, visually unobtrusive, and dead-simple to use. Doesn't interfere with closing my Macbook at all, it protrudes less than the rubber bumper around the screen border. Still miss the physical mic mute button on my old Thinkpad X230...…

FWIW I had one of these on my laptop and the screen now has a crack that started right where this was.

Re: Camera and microphone require HTTPS in Firefox 68

#74

Post by toxik »

ehsankia wrote: post #58
skybrian wrote: post #29

Earlier quoted context omitted.

That's useful, but it's not as reassuring as a hardware switch where you can see it work. (For video, anyway. I don't see any similar solution for audio.)

Two reasons why switch is better: 1. If it does happen to light up, what would you do, turn off your computer? That's shitty. 2. What if your AFK and aren't looking at the light?

Arguably better to be aware of the breach than prevent one sensor from leaking too.

Re: Camera and microphone require HTTPS in Firefox 68

#75

Post by asveikau »

zonidjan wrote: post #67
arcticbull wrote: post #44

Earlier quoted context omitted.

The kernel is not BSD, it's based on the Mach microkernel [1] with a BSD compatibility layer implemented on top. The whole thing collectively is called XNU [2]. [1] https://en.wikipedia.org/wiki/Mach_(kernel) [2] https://en.wikipedia.org/wiki/XNU

It was developed from something that was based on Mach. However, it is also based on BSD, as your second link states. > The BSD code present in XNU came from the FreeBSD kernel. Although much of it has been significantly modified, code sharing still occurs between Apple and the FreeBSD Project.

The description of "Mach with a BSD layer on top" was nonetheless accurate. When you look at actual BSD you will see it is rather un-Mac-like, so I don't think it is a highly relevant comparison. (The path drawn here from the Purism laptop to XNU is very dubious.)

Re: Camera and microphone require HTTPS in Firefox 68

#76

Post by ljm »

kevin_thibedeau wrote: post #63
sangnoir wrote: post #49

Earlier quoted context omitted.

LED brightness is controlled by pulse-width modulation: at low frequencies, the camera LED would appear dimly lit. A more sophisticated approach might be to combine gaze detection to ramp-down frequency if someone is looking towards the camera/LED.

A momentary flicker would not be perceptible in a lit room.

A momentary click on a phone line was also imperceptible... until it wasn’t.

You might not even see the flicker but if you catch it in your peripheral vision often enough, or you found out someone else was caught by it or it hit the news big time, you’d suddenly become more suspicious about that momentary flash. Maybe even paranoid.

Re: Camera and microphone require HTTPS in Firefox 68

#77

Post by seandougall »

css wrote: post #35
XCSme wrote: post #30

Earlier quoted context omitted.

I remember there was a story saying that it's possible, via software only (due to a "bug" and some "poor" hardware design), to turn on the camera without activating the LED.

https://jscholarship.library.jhu.edu/handle/1774.2/36569 (2013)

Published in 2013, but describes "the Apple internal iSight webcam found in previous generation Apple products including the iMac G5 and early Intel-based iMacs, MacBooks, and MacBook Pros until roughly 2008".

Re: Camera and microphone require HTTPS in Firefox 68

#78

Post by ljm »

ehsankia wrote: post #58
skybrian wrote: post #29

Earlier quoted context omitted.

That's useful, but it's not as reassuring as a hardware switch where you can see it work. (For video, anyway. I don't see any similar solution for audio.)

Two reasons why switch is better: 1. If it does happen to light up, what would you do, turn off your computer? That's shitty. 2. What if your AFK and aren't looking at the light?

A switch plus a notification (as opposed to modal prompt) if you try to get into video/audio calls but forget to flip it back. Just to remind you that you’re trying to enable video/mic but have the hardware switched off.

Re: Camera and microphone require HTTPS in Firefox 68

#79

Post by TheRealSteel »

kraig wrote: post #73
sethhochberg wrote: post #61

Earlier quoted context omitted.

If anyone is looking for a nice webcam cover for laptops, I've found the super-thin ones (marketed as "0.7mm thin" by EYSOFT and others on Amazon, etc) are fantastic. Very cheap, very thin, visually unobtrusive, and dead-simple to use. Doesn't interfere with closing my Macbook at all, it protrudes less than the rubber bumper around the screen border. Still miss the physical mic mute button on my old Thinkpad X230...…

FWIW I had one of these on my laptop and the screen now has a crack that started right where this was.

Also note that the webcam closes onto the large, glass trackpad on Apple laptops, increasing the risk of damage if any debris gets in between there.

Re: Camera and microphone require HTTPS in Firefox 68

#80

Post by Guest0918231 »

asdfasgasdgasdg wrote: post #36
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

I think I understand the risk, and I definitely would not bother with such a switch even were it available. So maybe I actually don't understand it. What exactly is the risk? Have there been any actual cases of someone being spied on with their laptop webcam that would have been prevented by a switch? I'm only aware of cases where the webcam switch would not have helped (e.g. roommate sets up notebook to record owner…

When I was in highschool people would do this all the time to each other by attaching trojans to files to gain access to webcams. This was the days of Windows 98, and security was almost non-existent for most users.

People would get someone infected, and then share the credentials so everyone could watch. So, I personally know of a handful of people that were spied on 20 years ago.

Post reply on HN