Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wyze security incident update

forums.wyze.com

Post reply on HN
Print view View original

71–80 of 161 posts

Re: Wyze security incident update

#71

Post by dns_snek »

jabart wrote: post #56
darkwater wrote: post #21

Earlier quoted context omitted.

Yes but either the library is seriously bugged (like, expecting writes to be ordered and screwing up things if it gets too many writes for different objects at the same time) or there was some serious bug in their implementation. Anyway the attitude and the message passed in the communication seems like handwashing to me. I might be too cynic, though.

How else would you say a 3rd party library had a bug under heavy load? 1. You don't want a defamation lawsuit your way. 2. If it was vendor code, you have a contract that may be under a NDA. 3. If it was a vendor, lawyers, lots and lots of lawyers, they likely had to say the minimal amount. The fact they sent out communications for each type of incident in such a short time was great.

I might be splitting hairs, but they say that the incident was "caused by a third party library" when in fact, the incident was caused by insufficient testing on their part.

It sounds like they're trying to shift blame for the incident but then they try to pat themselves on the back for all the effort they put into security. It comes across as dishonest.

Technical details are appreciated but they should've emphasized that this is their own fault. Bonus points if they commit to at least consider E2EE which would sidestep the issue.

Re: Wyze security incident update

#72

Post by sneak »

LeafItAlone wrote: post #22
sneak wrote: post #4

Nobody should ever be surprised that sending video to someone else’s computer (ie “the cloud”) results in third parties viewing that video.

It’s 2024. Everything is connected to the internet. Dropbox, Google, and Apple all offer multiple terabyte level plans. The default today is to store in the cloud. We are all storing data in someone else’s computer. Instead of blaming the users, we must hold the companies responsible. Data privacy laws must be stricter and these incidents must be taken more seriously.

You can indeed make laws to hold the companies responsible, but that's not going to change the situation where it's dumb to store private information on systems that aren't under your control.

You might be able to cause consequences after the fact, but your data will still get leaked first. You can't undo a privacy violation with tort law, and there won't ever be criminal penalties.

If you want your information to stay private, don't store it on other people's computers. IDGAF what "the default today" is. (Also, that's wrong - everyone that is serious and actually wants their data to remain private doesn't store it in the cloud. This is why the CIA got Amazon to build a custom airgapped on-prem AWS region at Langley, for instance.)

Re: Wyze security incident update

#73

Post by sponaugle »

prmoustache wrote: post #48
sponaugle wrote: post #46

Earlier quoted context omitted.

The primary use case for a camera watching something that might get stolen is to provide proof of theft for insurance. In some cases it can provide clear evidence of what exactly was stolen, and in some cases information about who stole it. Unless the camera has lasers, it isn't very good at stopping said theft. ;)

Why would your insurance require a proof of the theft? That is not how insurances work usually.

There is tremendous variance with what will be 'required' to complete an insurance claim. In some cases a simple statement will suffice. In others, a police report is sufficient. In some cases the insurance company will want to 'investigate'. In many cases the underwriter will have some additional requests.

However it is always good to recognize the primary goals of the insurance parties - which is to not pay. They have strong incentives in that direction, and you providing proof of theft reduces the opportunities for those incentives to slow or reduce the payment.

It is especially true in cases of undeclared specific items, like an expensive mountain bike that you do not have a dedicated policy on.

Re: Wyze security incident update

#74

Post by sponaugle »

jt2190 wrote: post #66
lopkeny12ko wrote: post #52

Earlier quoted context omitted.

Of course you need to provide proof of theft. I can't simply go to my insurance, file a claim for a high-value item, and expect them to not ask any more questions. This would be rife with fraud (read: not a reasonable business model) otherwise.

> Of course you need to provide proof of theft. Generally filing a police report will suffice, if I’m not mistaken. Could you lie? Of course, but (1) it’s generally not in your best interest because the insurer might raise your rates and/or discontinue coverage, and (2) you’d be making a decision to make false statements to the police for purpose of fraud, which most reasonable people won’t do. Other than perhaps usi…

"Other than perhaps using cameras as a means to deter thieves, I’m not sure that low-value (under USD 5000) items like bicycles are worth the time and effort for insurers to launch full investigations over."

I would agree, yet I have seen it happen. It is a somewhat difficult to predict path. I have seen some smaller claims (~$2000) take significantly longer and with more investigation than other very large (>$50,000) claims. I would assume there are certain metrics and algorithmic methods that effect how this plays out, so it is possible that someone who has had multiple small claims my get more attention than a single large claim.

Either way - The concept of the camera is simple in providing evidence in cases where that evidence can help you.

Re: Wyze security incident update

#75

Post by voakbasda »

Another in a long line of reasons to avoid low price, off-the-shelf, unauditable, cloud-enabled cameras.

I continue to be amazed that there is not a reasonably priced, open source, audited, local-first solution, which doesn’t require a significant personal investment of time to install and maintain.

Re: Wyze security incident update

#76

Post by LeafItAlone »

sneak wrote: post #72
LeafItAlone wrote: post #22

Earlier quoted context omitted.

It’s 2024. Everything is connected to the internet. Dropbox, Google, and Apple all offer multiple terabyte level plans. The default today is to store in the cloud. We are all storing data in someone else’s computer. Instead of blaming the users, we must hold the companies responsible. Data privacy laws must be stricter and these incidents must be taken more seriously.

You can indeed make laws to hold the companies responsible, but that's not going to change the situation where it's dumb to store private information on systems that aren't under your control. You might be able to cause consequences after the fact, but your data will still get leaked first. You can't undo a privacy violation with tort law, and there won't ever be criminal penalties. If you want your information to st…

A main draw of these “security” cameras is to be able to remotely monitor the locations where they are, including being able to events in the event the devices are stolen. Should I build my own off site, redundant, data centers to make this possible without using a cloud service?

> Also, that's wrong - everyone that is serious and actually wants their data to remain private doesn't store it in the cloud. This is why the CIA got Amazon to build a custom airgapped on-prem AWS region at Langley, for instance.)

Do you think that “everyone that is serious and actually wants their data to remain private” is the default? In a random sampling of 100 people, how many do you think fall into this category?

> This is why the CIA got Amazon to build a custom airgapped on-prem AWS region at Langley, for instance.

Is your threat model the same as Langley’s? Or might there just be different levels of what people’s needs are?

There’s ideals and there’s practicality. It’s impractical in today’s world to completely avoid cloud services. If you can do it, congratulations, more power to you.

Re: Wyze security incident update

#78

Post by achille »

twisteriffic wrote: post #2

> The incident was caused by a third-party caching client library that was recently integrated into our system. This client library received unprecedented load conditions caused by devices coming back online all at once. As a result of increased demand, it mixed up device ID and user ID mapping and connected some data to incorrect accounts. That seems like enough of a line of bullshit to steer me away from ever using…

Same thing happened to OpenAI. Will you steer clear of OpenAI forever as well?

https://news.ycombinator.com/item?id=35294082

Re: Wyze security incident update

#79

Post by zzyzxd »

darknavi wrote: post #45

This is the sort of thing that makes me salty that Unifi Protect is basically cloud locked in. No direct IP connection with "local" account support on the mobile app.

direct IP connection is coming: https://community.ui.com/questions/Unifi-Protect-Mobile-acce...

but even with this, it's still an security camera app that can't send push notification without cloud access.

Re: Wyze security incident update

#80

Post by wutwutwat »

twisteriffic wrote: post #2

> The incident was caused by a third-party caching client library that was recently integrated into our system. This client library received unprecedented load conditions caused by devices coming back online all at once. As a result of increased demand, it mixed up device ID and user ID mapping and connected some data to incorrect accounts. That seems like enough of a line of bullshit to steer me away from ever using…

There are only two hard things in Computer Science: cache invalidation and naming things.

-- Phil Karlton

Post reply on HN