Hacker News Reader

Comment by axoltl | Hacker News Reader

Hi!

I was the security architect for this feature on recent Macs. The LED is wired to the camera PMIC and is powered by the voltage rail that powers the camera. The PMIC will always remain on if the system has power. Macs newer than 4 or so years also have a feature that forces the LED to stay lit for at least 3 seconds after it has been turned on to prevent the single-frame-grab attack.

View on HN

> to prevent the single-frame-grab attack.

prevent? by the time the LED turns on, the attack has already happened.

Prevent it from being undetectable

Or to put it simply "to detect the single frame grab attack". LED lights can't prevent anything.

Provided you looked at the camera light in those 3 seconds.

I am wondering: how does Mac know whether you are in a light room or a dark room to adjust its screen's brightness without activating the camera?

There’s a separate ambient light sensor.

That's a separate sensor - see https://apple.stackexchange.com/questions/347895/where-is-th...

Ah, good. Is the microphone similarly protected? Sometimes I feel I must be the only person on earth who doesn't use their laptop while naked and couldn't care less if the imager was watching me. The microphone, however, could be an actual security threat. Phone calls, muttered passwords, etc.

Out of curiosity...

Do the doors at Apple HQ have locks? Or is there just a little LED next to them that lights up when they open?

There is a little LED that lights up when they open. The door latch is controlled via software and so is the light, though I would assume in the case of power failure they'd unlock for fire safety reasons.

Ok. So there is not only a LED, but a physical latch.

I think Apple's building security architect should have a conversation with their camera security architect.

I know where you were going with that, but the situation is different than what you’re trying to show. On Macs the light is on the path of the camera: if it is on the camera is, if it is not then the camera is not. Whereas with the door you might think that if it was latchless someone could just push it open when the light was off. The camera light is really a door alarm, not a door latch. (And as I just mentioned, doors with an alarm but no lock often do exist, usually for fire safety reasons).

No, the situation is in fact the exact same.

A door without a latch does not prevent an unauthorized person from trespassing. A camera without a cover does not prevent an unauthorized person from trespassing.

Apples webcams are broken by design.

Other companies fixed theirs years ago: https://www.youtube.com/watch?v=37NFVGLX3vw

So you have to perpetually watch out for the LED indicator to see if it ever randomly turns on for 3 seconds? And what if it does come up unexpectedly? At this point it's too late and you've already been captured. A mechanical cover that can slide on and off the camera seems like much better security.

Except that people will forget to use them

You don't "have to" do anything.

The point is that the hardware has been designed properly. Combined with the OS-level permissions, it should be assurance enough for the majority of use cases.

If you need further assurances, then by all means, use a physical cover.

The claim was that single-frame grab attempts are prevented by an indicator that stays on for 3 seconds. First, you do have to be alert for all of these potential 3 seconds windows, and second, it doesn't prevent anything but only tell you that it has already happened.

No, it wasn't. The claim was whether it was implemented correctly, as the entire conversation started with examples where it was not implemented correctly.

Properly designed hardware would add one small - and in every way possible, since we've already identified the circuit that drives the single power source - addition. A physical switch that prevents camera from being turned on. Same for the microphone. Unfortunately, this is never done. So people put covers on.

Reply on news.ycombinator.com