I found a backdoor into my bed • Hacker News Board

Re: I found a backdoor into my bed

#91

Post by [deleted] » Fri, Feb 21, 2025, 7:31 PM UTC

moolcool wrote: post #31

EvanAnderson wrote: post #3

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

I wonder if there'd be a cottage industry for new control boards which de-shittify IOT devices but keep their functionality. Like buy the bed, and then buy a little pre-programmed ESP32 logic board to replace the factory board.

[deleted]

Re: I found a backdoor into my bed

#92

Post by dylan604 » Fri, Feb 21, 2025, 7:31 PM UTC

amarcheschi wrote: post #51

megadata wrote: post #12

Earlier quoted context omitted.

I've also heard people are having excellent sleep in their traditional modern beds. Me included.

I've also heard about people finding new foam mattresses too hot :( like me. will buy a spring mattress next time Edit thank you for your recommendation but I'm in italy, European and American mattresses are quite different. Before discovering this, I once wrote to the customer support of the flamingo hotel, Las Vegas, because I loved their mattress: Hi, i do think that what i'm gonna write is weird, but anyway haha.…

Have you tried a more firm foam mattress? I had similar sentiments about foam mattresses but they were all the type where you just feel like you're sinking into the foam.

Re: I found a backdoor into my bed

#93

Post by yuvalr1 » Fri, Feb 21, 2025, 7:32 PM UTC

Are there any consumer products offered that provide similar functions (heating, controlling with an app etc.), but which never try to connect to a remote server, other than looking for the control app in the local LAN?

Re: I found a backdoor into my bed

#94

Post by mimischi » Fri, Feb 21, 2025, 7:32 PM UTC

electroly wrote: post #86

I'm a two-time Eight Sleep customer and the CEO could post my sleep history specifically with my full name and I'd still use it. It's really comfortable. I think most of the detractors were never remotely in the market for such a product. Everything negative said about the product and the company is true, and they should do better, but it's not enough to scare me away thanks to how good the base product is.

But is it more comfortable, then say, an old school analog expensive mattress? I can’t shake the feeling these companies are selling snake oil (that is not to say that old school analog mattresses aren’t overpriced either)

Re: I found a backdoor into my bed

#95

Post by Linkd » Fri, Feb 21, 2025, 7:32 PM UTC

nadis wrote: post #2

"When I say backdoor, what am I referring to? Sure, Eight Sleep needs a way to push updates, provide service, and offer support. That’s expected. What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process. And yes, I found evidence that this is exactly what’s happening." ^ wow, this…

even more so combined with the fact that these are supposedly being sent into the government.

Re: I found a backdoor into my bed

#96

Post by paldepind2 » Fri, Feb 21, 2025, 7:32 PM UTC

avalys wrote: post #73

This is a bunch of nonsense, assumption and leaping to conclusions without evidence. "In the second screenshot, we have the public key that’s authorized to access the device. The email address attached to the public key, eng@eightsleep.com, to me suggests the private key is likely accessible to the entire engineering team." He has no evidence for this whatsoever and not really any good reason to assume it either. "In…

I don't really understand the take here. The post makes it very clear what is concrete evidence, what is speculation based on that, and the reasoning is much better than what you give it credit for. For instance, what would you suggest the "remote-connectivity-api" SSH endpoint URL and the authorized public SSH key is for if not for remotely SSHing into the bed's computer?

Re: I found a backdoor into my bed

#97

Post by api » Fri, Feb 21, 2025, 7:32 PM UTC

EvanAnderson wrote: post #3

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

This product would be hard to believe if it showed up in an episode of Black Mirror.

Re: I found a backdoor into my bed

#98

Post by TheGRS » Fri, Feb 21, 2025, 7:33 PM UTC

> In the end, I got enough of the cyber ick, I decided to seek a simpler, less internet-connected solution to my temperature-controlled bed needs.

Great line. And my eyes bugged out a little at this part as I also realized what the implications were:

> - They can know when you sleep

> - They can detect when there are 2 people sleeping in the bed instead of 1

> - They can know when it’s night, and no people are in the bed

I have a more pragmatic question. Do any consumer publications do security reviews for products? I'm thinking like consumer reports and how they should probably publish if a product is a security nightmare or not. At the end of the day you still need people publish this stuff out and for social media to spread to consumers to beware, but maybe a magazine type of publication could take on part of that responsibility.

Re: I found a backdoor into my bed

#99

Post by janpot » Fri, Feb 21, 2025, 7:33 PM UTC

EvanAnderson wrote: post #3

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

step one is to stop pretending the market is a democracy

Re: I found a backdoor into my bed

#100

Post by keysersoze33 » Fri, Feb 21, 2025, 7:33 PM UTC

I bought an Eight Sleep Pod 3, as I'm light sleeper who wakes up often at 3 or 4am, and struggles to get the final hours of sleep.

I have to say it made my sleep significantly worse - I was shocked at how bad the temperature setting was - shifting 1 degree warmer or colder was often too much. I also noticed quite a bit of manipulation of reviews & comments on Reddit / subtle sponsorship on YouTube. (=> fake comments, upvoting/downvoting, and unofficial sponsorship).

Maybe it really does improve some people's sleep, but just the noise itself from the Pod meant I needed earplugs to not be disturbed by it. My suggestion is to avoid buying at all costs...