Hacker News Reader

Comment by ollie87 | Hacker News Reader

Yeah, this has absolutely nothing to do with Nest and everything to do with people using the same passwords for different sites.

View on HN

Yes, but that is a pedantic technicality that misses the point. Google markets Nest's ease-of-use and plug-and-play simplicity to non-tech users. That's a critical piece of the product's value proposition: that it just works and you don't have to think too much about it. For user security not to be a major design consideration from the onset seems extremely shortsighted... especially since this is an internet-connected camera that you're placing all over your home. Not thinking about security and privacy implications was Google's first failing. The second failing is its broken culture when it comes to customer support.

Does Google/Nest partner with haveibeenpwned to invalidate leaked creds and force a reset by the user? Forcing MFA would also not be unreasonable considering the sensitivity of the data collected (ie video in your home), although I get this is up for vigorous debate between product, security, and engineering.

Google defends Gmail users from malicious nation state actors [1]. Isn't Nest part of the Google identity ecosystem now?

[1] https://security.googleblog.com/2012/06/security-warnings-fo...

I didn't think HIBP did password hash sharing?

They sure do and in fact offer an API for sites to validate sha-1 hashes against their cracked password DB[0]. The hashes are shared.

Thank you to Troy Hunt

[0] https://haveibeenpwned.com/API/v3#PwnedPasswords

That's not really what I was getting at. I've implemented the password lookup before. That protects users from setting passwords that have already been compromised.

The scenario I was looking at was..

User signs up with Site A with Password 1.

User signs up with Nest with Password 1.

Site A gets compromised.

Nest couldn't know if you'd used the same password on each site. The only way they could know is if they used the same hashing algo with the same salt or SHA-1 with no salt. Highly unlikely.

I suppose Nest could check the Pwned Passwords API every time they logged in, but I haven't seen anyone deploy that yet, IIRC all solutions I've seen check Pwned Passwords API when the set the password. Setting a password and checking a password are often different systems.

you can also download the passwords

Google has their own system for detecting compromised passwords: https://www.blog.google/technology/safety-security/password-...

I have no idea if it's integrated with their primary login flow though. It's certainly integrated with the password manager in Chrome.

Nope.

One easy fix. Send a verification email to users when a different device is detected before allowing log in.

I mean, even Steam does this.

Reply on news.ycombinator.com