Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Camera and microphone require HTTPS in Firefox 68

blog.mozilla.org

Post reply on HN
Print view View original

91–100 of 215 posts

Re: Camera and microphone require HTTPS in Firefox 68

#91

Post by mort96 »

varenc wrote: post #23
petters wrote: post #2

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168. . . Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.

For local development, Chrome has a flag that lets you force specific origins to be treated as secure: chrome://flags/#unsafely-treat-insecure-origin-as-secure I don't think Firefox has anything equivalent though? This bug on the topic is unassigned: https://bugzilla.mozilla.org/show_bug.cgi?id=1410365

I don't imagine that works on mobile chrome, which is what the parent comment was talking about.

Re: Camera and microphone require HTTPS in Firefox 68

#92

Post by Dylan16807 »

rolltiide wrote: post #83
indalo wrote: post #28

Earlier quoted context omitted.

that's wpengine's cdn, most likely the host of the blog.

Its funny how everyone feels empowered to be a digital sleuth these days but makes ridiculous conclusions with the same material everyone else has

"wtf?" is not a ridiculous conclusion.

Re: Camera and microphone require HTTPS in Firefox 68

#93

Post by mort96 »

hannob wrote: post #50
petters wrote: post #2

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168. . . Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.

> It would be nice if it also worked on local IPs, like 192.168... That would defeat the security purpose. Anyone within your local network (which practically speaking very often means the next Wifi your device could find) could attack you.

But how do you do local development when you can't get an SSL cert for your dev machine's server? No, self signed certs don't always do what you need, especially on mobile where you can't just add your cert as a trusted cert easily.

Re: Camera and microphone require HTTPS in Firefox 68

#94

Post by vortico »

mort96 wrote: post #90
vortico wrote: post #87

Earlier quoted context omitted.

It's fantastic that it works with localhost (and I assume 127.0.0.1?), and it's fantastic that it doesn't work with anything else. This is the best middleground.

When it doesn't work on anything other than localhost, you can't host a web server on your dev machine and test how it works on your phone. I've been through the hell of trying to test WebRTC applications on mobile Safari, and it's horrible. Specifically, you need HTTPS for WebRTC, but you obviously have to use a self signed cert because local IP. You can ignore the cert error and load the page, but connecting to the…

I see your point about mobile testing. (I don't do mobile work, so I didn't think of it.)

Re: Camera and microphone require HTTPS in Firefox 68

#95

Post by 0x0 »

rxhernandez wrote: post #41
Wowfunhappy wrote: post #38

Earlier quoted context omitted.

This is a better solution overall, as it's "by default". A hardware switch relies on the user to be privacy conscious. An LED which is physically connected to the camera circuit (!) is immediately noticeable if it turns on unexpectedly.

As a layperson in this arena, I'm skeptical as to whether it's a great solution. Is it possible to turn the camera on and off very quickly? If so, a smart hacker could do that really quickly and if the owner ever notices they would probably think there is a problem with the electrical rather than thinking they are being monitored.

If you install Oversight, you can get persistent notification center alerts for most mic and cam activations (of course, it likely won't help if you have targeted malware that knows how to disable/uninstall Oversight) - https://objective-see.com/products/oversight.html

Re: Camera and microphone require HTTPS in Firefox 68

#96

Post by asdfasgasdgasdg »

packet_nerd wrote: post #56
asdfasgasdgasdg wrote: post #36

Earlier quoted context omitted.

I think I understand the risk, and I definitely would not bother with such a switch even were it available. So maybe I actually don't understand it. What exactly is the risk? Have there been any actual cases of someone being spied on with their laptop webcam that would have been prevented by a switch? I'm only aware of cases where the webcam switch would not have helped (e.g. roommate sets up notebook to record owner…

A quick search seems to turn up quite a few examples of webcam spying. I'd love to see actual numbers, but it doesn't seem to be "incredibly rare". https://www.dailymail.co.uk/sciencetech/article-5228017/Hack... https://www.dailymail.co.uk/news/article-2638874/More-90-peo... https://globalnews.ca/news/2158281/what-you-need-to-know-abo... https://www.telegraph.co.uk/technology/news/10131456/Hackers... This site claims…

OK. That has caused me to update my beliefs. I still think that there is relatively little risk -- like, you should be much more worried about being in a car accident -- but I no longer think it's on par with being struck by lightning.

Re: Camera and microphone require HTTPS in Firefox 68

#97

Post by numtel »

klodolph wrote: post #14
nhumrich wrote: post #5

Earlier quoted context omitted.

You could add a tunnel via iptables to just route one port on localhost to another ip

iptables on your phone? I think you would need to root your phone, if it's Android.

No need to root, with android in developer mode, run this to forward localhost:3000 to the same port on the phone.

> adb reverse tcp:3000 tcp:3000

Re: Camera and microphone require HTTPS in Firefox 68

#98

Post by sbov »

asdfasgasdgasdg wrote: post #36
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

I think I understand the risk, and I definitely would not bother with such a switch even were it available. So maybe I actually don't understand it. What exactly is the risk? Have there been any actual cases of someone being spied on with their laptop webcam that would have been prevented by a switch? I'm only aware of cases where the webcam switch would not have helped (e.g. roommate sets up notebook to record owner…

A while back it was in the news that school issued laptops had their webcams remotely activated by administration during non school hours. So yeah there's been at least one case.

Re: Camera and microphone require HTTPS in Firefox 68

#99

Post by outworlder »

atonse wrote: post #9
asark wrote: post #6

Dear Apple: for Christmas I'd like physical, no-bullshit power shutoff switches for your camera and microphone on the Macbook Pro. Other devices too—if you can manage it, that'd be great. Sincerely, the people who put tape over their cameras, the people who don't because it's ugly and messes with closing the lid but wish they could, and the people who would be in one of those two camps if they understood the risk (so…

From my understanding, Apple has done sort of what you're asking for, they've hooked up the physical wiring of the camera LED to the camera itself, so it is physically impossible to power the camera without the LED being turned on (as opposed to the "turn on LED" being part of firmware logic that could be hacked).

> From my understanding, Apple has done sort of what you're asking for, they've hooked up the physical wiring of the camera LED to the camera itself, so it is physically impossible to power the camera without the LED being turned on

Correct. And that was my reason for NOT covering the camera. Because I would be able to see if it was on due to some malware. However, I did not expect a vulnerability like Zoom's, where a simple website would be able to trigger a webcam. Combined with external monitors, the LED would be potentially missed for a good amount of time. So I've reversed my position since then.

Re: Camera and microphone require HTTPS in Firefox 68

#100

Post by maxk42 »

vortico wrote: post #87
petters wrote: post #2

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168. . . Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.

It's fantastic that it works with localhost (and I assume 127.0.0.1?), and it's fantastic that it doesn't work with anything else. This is the best middleground.

Would be better if it also supported a new warning / permission to request insecure camera access.
Post reply on HN