Hacker News Reader

Comment by Cpoll | Hacker News Reader

> Essentially, an email and a password are compromised somewhere across the internet. They join millions of other email addresses and passwords, which are then cross-referenced with other websites, including Nest.

This doesn't sound like a Nest vulnerability? Does Nest offer MFA?

View on HN

People reusing passwords and email adresses is a known problem and not rare at all. So deal with it, i.e. you need to make sure that your service can not be affected by a simple leak. Not doing so means putting the security of your users and their experience with your product into the hands of other people (everyone who knows the email and password combination of your user).

Ideally, being susceptible to a leaked password-email-combination should be considered gross negligence.

> you need to make sure that your service can not be affected by a simple leak

How can you use any service then if in your mind any service should be be able to not be affected by a leak?

My username/password combo is everything I need to use my account fully. Should there be another factor to use my account? I should be forced to get set another factor to post on HN?

This is just absurd. We just can't keep increasing road block to let people not learn how to use something. There will always be an idiot to outsmart you.

Yeah, I clicked this assuming (with a bit of surprise) that Google's IoT device security is as paper-thin as all the rest, but this was 100% user error. I don't know what he expects Google to do about it.

Yeah, this has absolutely nothing to do with Nest and everything to do with people using the same passwords for different sites.

Does Google/Nest partner with haveibeenpwned to invalidate leaked creds and force a reset by the user? Forcing MFA would also not be unreasonable considering the sensitivity of the data collected (ie video in your home), although I get this is up for vigorous debate between product, security, and engineering.

Google defends Gmail users from malicious nation state actors [1]. Isn't Nest part of the Google identity ecosystem now?

[1] https://security.googleblog.com/2012/06/security-warnings-fo...

I didn't think HIBP did password hash sharing?

They sure do and in fact offer an API for sites to validate sha-1 hashes against their cracked password DB[0]. The hashes are shared.

Thank you to Troy Hunt

[0] https://haveibeenpwned.com/API/v3#PwnedPasswords

That's not really what I was getting at. I've implemented the password lookup before. That protects users from setting passwords that have already been compromised.

The scenario I was looking at was..

User signs up with Site A with Password 1.

User signs up with Nest with Password 1.

Site A gets compromised.

Nest couldn't know if you'd used the same password on each site. The only way they could know is if they used the same hashing algo with the same salt or SHA-1 with no salt. Highly unlikely.

I suppose Nest could check the Pwned Passwords API every time they logged in, but I haven't seen anyone deploy that yet, IIRC all solutions I've seen check Pwned Passwords API when the set the password. Setting a password and checking a password are often different systems.

you can also download the passwords

Google has their own system for detecting compromised passwords: https://www.blog.google/technology/safety-security/password-...

I have no idea if it's integrated with their primary login flow though. It's certainly integrated with the password manager in Chrome.

Yes, but that is a pedantic technicality that misses the point. Google markets Nest's ease-of-use and plug-and-play simplicity to non-tech users. That's a critical piece of the product's value proposition: that it just works and you don't have to think too much about it. For user security not to be a major design consideration from the onset seems extremely shortsighted... especially since this is an internet-connected camera that you're placing all over your home. Not thinking about security and privacy implications was Google's first failing. The second failing is its broken culture when it comes to customer support.

Nope.

One easy fix. Send a verification email to users when a different device is detected before allowing log in.

I mean, even Steam does this.

They offer MFA, only via SMS.

Not perfect, but, its decent.

I still use it and will continue to do so until someone releases a better ecosystem.

Right now I get an alert on my phone if someone rings the bell, or leaves/removes a package. Plus with facial recognition I get alerts which include the person's name for common visitors (via facial recognition) and will announce visitors via a set of google home minis. Nest will alert my phone if the smoke detector sees smoke or CO. I'm obviously quite "all in" on their ecosystem.

I also will note I have an elderly relative at home as well as 3 dogs and we are not there most days so the ability to see what's going on at home and potentially take action like calling the police/fire/EMS is extremely valuable to me.

Yes, Nest offers MFA. You should enable it now:

https://support.google.com/googlenest/answer/9295081?hl=en

> Does Nest offer MFA?

I don't remember what Nest used before being bought by Google (I believe SMS MFA was available), but they're transitioning accounts to sign in with your Google account.

But, if you transition, you lose some significant existing functionality and integration.

I've gone "all in" on turning on MFA, preferring TOTP when possible, over the last ~6 months.

A surprising number of sites that really should do not offer any MFA. Like bank accounts, credit cards, investing accounts, payroll, cars...

My money may not be safe, but at least my github commits are!

Yes, Nest has offered MFA for years. The blame for this incident falls squarely on the user, who reused the same (weak?) password across multiple websites without enabling MFA.

One the one hand I agree the specific issue is the user fault. On the other hand, you're selling internet controlled audio and video recorders to the general public. What did you expect?

Every single day people crash cars, cut themselves on kitchen knives, and choose weak methods of single-factor authentication. There’s only so much the seller can do. We’ve seen how much users love (and subvert) “strong password requirements.”

IMO, the device should require MFA to be configured before working, using it without one should be left at most as an “advanced setting”.

Reply on news.ycombinator.com