Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a backdoor into my bed

trufflesecurity.com

Post reply on HN
Print view View original

71–80 of 403 posts

Re: I found a backdoor into my bed

#71

Post by skizm »

martinsnow wrote: post #17
kaonwarb wrote: post #14

Interesting article; clickbait title. There's very little about Amazon in here, never mind its chairman.

It drives clicks! I don't understand why someone would buy a bed chiller. But perhaps the US is a unique market.

I’m in the market for one. I want a cool sleep in the summer with fresh air (not recycled AC air). I haven’t found one with good reviews and also no required spyware unfortunately. So AC plus humidifier is needed, but I still sweat on the parts of my body in contact with the mattress no matter how much I crank the AC in the middle of Aug.

Re: I found a backdoor into my bed

#72

Post by SeanAnderson »

nadis wrote: post #2

"When I say backdoor, what am I referring to? Sure, Eight Sleep needs a way to push updates, provide service, and offer support. That’s expected. What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process. And yes, I found evidence that this is exactly what’s happening." ^ wow, this…

Sounds like a good way to get bed bugs.

.. I'll see myself out.

Re: I found a backdoor into my bed

#73

Post by avalys »

This is a bunch of nonsense, assumption and leaping to conclusions without evidence.

"In the second screenshot, we have the public key that’s authorized to access the device. The email address attached to the public key, eng@eightsleep.com, to me suggests the private key is likely accessible to the entire engineering team."

He has no evidence for this whatsoever and not really any good reason to assume it either.

"In the first image, we see evidence SSH is being exposed remotely, to a far away host, remote-connectivity-api.8slp.net. Typically SSH would only be accessible to the local area network, but the variables in production.json would seem to imply this access was opened up to a remote host."

This isn't how SSH works and he doesn't seem to have enough information, or enough knowledge of SSH, to understand what's being done with the "far away" hostname.

This article is just clickbait nonsense, which should have been obvious from the title. It is clearly intended to draw traffic to their company website, which is some kind of venture-backed security startup. Based on the fact that the founders seem to have a superficial understanding of technology but a well-developed understanding of hype and bullshit, I am not interested in exploring their business further.

Re: I found a backdoor into my bed

#74

Post by modeless »

neogodless wrote: post #38
WalterBright wrote: post #34

I've bought several internet radio streaming devices over the years, and they all eventually brick when the server goes out of business.

I was so pleasantly surprised when my Microsoft / Harman Kardon "smart" speaker (Invoke) issued a firmware update upgrading it to act as a simple Bluetooth speaker. It's wildly more useful now! A rare exception to the usual.

Google has done this with the Stadia controller, and also recently open sourced the firmware for the Pebble smartwatch. They may discontinue a lot of stuff but their track record for discontinued hardware is pretty decent IMO.

Re: I found a backdoor into my bed

#75

Post by micromacrofoot »

sxp wrote: post #26

I have an EightSleep from before their enshittification into a subscription model. It is a good piece of hardware, but I can no longer recommend it because the software is so crappy. I checked the logs on my router and found that it was streaming tons of data to servers even when I wasn't using it. I have no idea why it would stream that much data since the trivial sensors it has shouldn't be producing that much data…

> I have no idea why it would stream that much data

I think the blog post uncovered that here... the CEO is a total creep

Re: I found a backdoor into my bed

#76

Post by darksaints »

jjice wrote: post #6
EvanAnderson wrote: post #3

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

I've heard the sleep people get with this is excellent, but no way in hell am I paying a subscription and requiring an internet connection for my bed. The entire concept is just absurd. If it sells, it sells, I guess.

I love my device...it has profoundly changed my quality of sleep on the same scale that CPAP therapy has.

Seeing the founder fellate Elon and his Doge employees has given me second thoughts. I may be looking for an aquarium chiller in my near future.

Re: I found a backdoor into my bed

#77

Post by geodel »

martinsnow wrote: post #17
kaonwarb wrote: post #14

Interesting article; clickbait title. There's very little about Amazon in here, never mind its chairman.

It drives clicks! I don't understand why someone would buy a bed chiller. But perhaps the US is a unique market.

I mean when someone says they are chilling in bed, they don't want to be lying.

Re: I found a backdoor into my bed

#78

Post by bloopernova »

My wife uses a Bedjet which has both a remote and app. Thankfully it works without an active Internet connection.

It uses a bag-like sheet that it blows air into, to adjust temperature. For women suffering* through menopause, being able to adjust around hot/cold flushes is sanity-preserving!

* Some women don't suffer much during perimenopause or menopause, but it's a process that seriously fucks with one's hormones. A word of advice to any partner of a woman going through perimenopause: believe them when they tell you what they're going through! So many partners don't realize just how much this can mess up someone, they deserve every sympathy possible.

Re: I found a backdoor into my bed

#79

Post by ta1243 »

j2kun wrote: post #20

> While the Eight Sleep CEO Matteo seems focused on providing DOGE with great sleep More sycophants coming out of the woodwork.

"We may not have that many outright Nazis in America, but we have plenty of cowards and bootlickers, and once those fleshy dominoes start tumbling into the Trump camp, the game is up"

That's the health secretary's words.

Re: I found a backdoor into my bed

#80

Post by throwway120385 »

sxp wrote: post #26

I have an EightSleep from before their enshittification into a subscription model. It is a good piece of hardware, but I can no longer recommend it because the software is so crappy. I checked the logs on my router and found that it was streaming tons of data to servers even when I wasn't using it. I have no idea why it would stream that much data since the trivial sensors it has shouldn't be producing that much data…

Because they want to know what you're doing in bed and when.
Post reply on HN