Hacker News Reader

Comment by rgbrenner | Hacker News Reader

As an alternative to a camera cover, use the camera indicator light to determine if your camera is active

I've been thinking about privacy all wrong. I thought it was about preventing access to my data... but Apple has cleared up my misunderstanding and now I know that it's just about being notified when my data is stolen.

Everyone feel free to post your credit card numbers... your privacy is secure, since your bank will let you know in the form of a bill when it's accessed without your permission.

Thanks Apple!

View on HN

If Apple makes such high-end stuff, and is marketing on privacy, why can't they spring for hardware switches? Pine64 does, and they're by no means high-end. Not by price, anyway.

I don't think the price of a hardware switch would be a concern for Apple, but the size would. A hardware switch would take up space. Apple broke their keyboards to shave a couple millimeters of thickness off their laptops.

You still have a silent mode toggle on your iphone. I think apple can figure out how to add a hardware switch for a camera/mic to a laptop without compromising thickness.

It doesnt need to be a hardware cover, just a hardware killswitch to the circuit.

> You still have a silent mode toggle on your iphone.

Yes, and it's one of, what, three moving parts left? Even the home button on the iPhone 7, 8, and 2020 SE is fake, it doesn't actually depress.

I think the removal of iphone buttons is for water resistance which I don't think applies to laptops.

Well, I can't speak to Apple's intentions, but consider they did the same thing with their laptop touchpads as they did the iPhone button. The touchpad used to actually depress, now it just vibrates to simulate feedback.

So... ?

Problem is people dont trust software. People want a hardwired fix.

(Thinking about this again, past the edit window—no, it's more than three parts. There's the (1) sleep/wake button, (2) (3) the two volume buttons, (4) and the vibration motor. And I guess (5) the speaker too, not sure if it counts. Still, it's not many.)

The Pinebook Pro uses a key combination, managed by the keyboard firmware. That's not quite as good as a hardware switch, but it shrinks the attack surface considerably.

This is the way to do it.

I always used to say I don’t cover the webcam on my MacBook Pro because any hack sufficient to activate it without my knowledge would mean the attacker already has root, including my bank login, etc, and I’d just be closing the barn door after the horses have left.

In the Covid era, however, my threat model is no longer unlikely malicious actors with root , but more plausible bugs in my conference software. I’m not worried that a statistically implausible attacker has a zero-day on my webcam, but that Zoom has a bug that will default the camera to on despite my settings as I join standup coming out of the shower. If there were a firmware-based gesture to explicitly turn the camera on, I wouldn’t need the tape.

Maybe they should focus more on functionality people want rather than reducing the size of the devices.

Making something bigger didn't seem to any kind of consideration when going from iPhone 5 to iPhone 6+.

Not necessarily. Apple owns the patent for a camera cover made of the privacy film that turns transparent with a switch; why they haven’t used it is beyond me.

We all know why they haven’t used it.

Better yet, Lenovo has a little plastic cover built into the camera under the lens.

I don't need to trust the implementation of some switch, I can physically cover up the camera with a nicely integrated cover. No trust required for about 0.01¢ of plastic.

Apple's old iSight webcams had a white iris that opened and closed by twisting a ring at the front of the camera. It was very nicely built and you could see whether the iris was closed from across the room.

Photo here: https://www.flickr.com/photos/mdpettitt/41991398752

Yup, such a simple solution, and Lenovo doesn't even make a fuss about privacy, they just "did it".

I mean... you still have to trust the implementation.

I can physically see that there is opaque plastic covering the camera lens. I don't need to trust in the hidden implementation of a LED or switch or anything. I can physically verify that the camera is disabled - meaning no trust.

>better yet

I disagree. Hw switch seems a bit more trustworthy/inspectable

Because it's about the marketing and not the reality. Having a hardware switch undermines the message that their OS is secure.

If you notice that the light is on, you won't be faster than the speed of light when you run to cover it.

True, Apple always knows what's best for its customers. 'It wouldn't let them shoot their own foot'[1].

[1]https://news.ycombinator.com/item?id=23797062

Are you seeing the indicator light go on when you aren't actively using the webcam?

The problem is if someone is able to activate your camera even if the light comes on 100 percent of the time, without a cover they’ll see something and will be able to capture that. Hey this guy hacked in and is seeing naked wife or my taxes on my desk or something else sensitive - the light isn’t really going to stop that. If you really don’t believe me go stay in a hotel next to defcon and use the hotel WiFi naked.

Do you believe that zero days don't exist? You think your laptop is absolutely hack proof?

A hacker isn't going to randomly burn their exploits, but that doesn't mean none exist.

I don't believe that zero days exist in a circuit, no. The LED is not software. You cannot power up the camera without powering up the LED.

>> As an alternative to a camera cover, use the camera indicator light to determine if your camera is active

I don't care because I don't use Apple but I still feel very offended as a human being.

WTF? How can they give such a disrespectful fuck-you response?

Actually it would be a huge security risk if everyone posted their CC numbers publicly. Attackers could use their numbers to make purchases, and by the time the purchases show up on the statement the money is already gone.

Banks don’t transfer money to CC merchants immediately - it happens later after the hold period is passed.

Also transaction can be reversed via chargeback.

Is it not clear that they're not complaining about the literal situation of credit card breach, but rather using it as analogy to being informed of a breach after the fact?

>I've been thinking about privacy all wrong. I thought it was about preventing access to my data... but Apple has cleared up my misunderstanding and now I know that it's just about being notified when my data is stolen.

This comment makes absolutely zero sense in more ways than one.

First, in the post Apple also says how you can control exactly which apps have access to the camera in the privacy settings. And, like, not give access to any, if you don't feel like so.

Second, the green light is not about "notified when your data is being stolen" is about being informed if/when you are filmed. In which case, you can just close the lid, quit the app, or do anything you like to prevent it.

Your reasoning is like arguing ironically against an alert vendor that "I thought the problem was getting my valuables stolen, but now the vendor has cleared up my misunderstanding and now I know that it's just about being notified when my valuables are stolen".

You’re missing the point. By the time the light is on it’s too late - your privacy has already been violated. Closing the lid only mitigates a camera privacy violation in progress. Covering the camera prevents the privacy violation from happening in the first place. One is a proactive measure and the other is reactive.

But in those few moments between when I notice the light and when I close the app/lid, my data has been stolen already.

If I'm in a compromising position, I don't want ANY footage of it to be created. If it is a so how frame or multiple seconds, I'm not okay with it. So being told that the notification light is equivalent to covering the camera entirely doesn't line up for me.

So you're saying everyone should always be staring at their webcam to make sure the light is not on? It isn't like there's a subfield of Human Factors studying Cognitive load[1], saying that people don't do a good job at what you're saying people should do. Also, have you ever heard of a rootkit?

[1] https://en.wikipedia.org/wiki/Cognitive_load

I always notice when the light goes on, because it's close to my screen, and effectively a form of movement in a place I don't usually see it. It's also quite bright on Apple computers. Is it different for other people?

I’m sure it’s different for many other people who use a second, larger monitor.

>> Is it different for other people?

Yes. Many people leave the laptop on, and wander off to pee. Or they're jerking off with their eyes closed. Or they are using a different computer at the same time in a data-center. Or all of the above at once.

That’s some impressive multitasking.

Many people do the same things and forget to cover their webcam with a piece of plastic. What’s your point?

Some people forget to lock their door sometimes. Should we remove the ability to have a lock on your front door?

How on earth can you say for certain you _always_ notice it? If it came on and you failed to notice it, well.. you wouldn't know would you. You'd still think you had a perfect record of always noticing it.

By the time the light comes on, the horse has left the barn.

Not really, the just have a few seconds of you.

Unless you were naked at the moment or doing heroin in the background you can just close the lid or cover the camera then and there...

I care about people filming me without me knowing. Not about someone trying to turn on my camera and me knowing immediately...

If, of course, they can bypass the already present "you need to give an app explicit permission to film" protection...

Reply on news.ycombinator.com