'Smart' doorbells for sale on Amazon came stocked with security vulnerabilities | Hacker News Reader

'Smart' doorbells for sale on Amazon came stocked with security vulnerabilities

which.co.uk

91 points0xmohit20 comments

From the linked article[0], which the posted URL appears to be a blogspam regurgitation of:

> After the seller of the Victure doorbell declined to give a refund, we took the case directly to Amazon, who agreed to fully refund the customer.

That’s probably the most viable way: if enough people request refunds, Amazon will have to address the shady sellers.

[0] https://www.which.co.uk/news/2020/11/the-smart-video-doorbel...

NCX (Negative Customer Experience) is the metric in question here.

Enough returns relative to other products in its category will first get the listing temporarily removed, and then permanently removed, if issues continue.

You can read a bit more here if interested: https://sellercentral.amazon.ca/gp/help/external/RTPNYUAU5EQ...

Ok, we've changed to that from https://www.cyberscoop.com/smart-doorbells-amazon-ebay-ncc-v.... Thanks!

Not surprising. They can’t keep obviously fake product like this off their site:

1000GB USB 2.0 Flash Drive 1TB Metal Design - Silver USB Flash Drive 1000GB https://www.amazon.com/dp/B0859Z28C2/ref=cm_sw_r_cp_api_fabc...

Despite alerting them, more fake product appears. Obviously 1TB for $29 isn’t a real product.

LockPickingLawyer has plenty of videos showing how pretty much everything that Amazon sells has security issues...

https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ

How's being on amazon relevant?

I think it indicates the reach of the product. The implication being that many more people are more likely to purchase the item if it is on Amazon rather than just being sold by a single retail site.

Because Amazon has a history of product quality and control problems.

How do other retailers compare? Are there any metrics?

Because the researchers bought the products from Amazon.

I also saw a very popular security camera product called Wyze that surreptitiously sends customer information to computers outside the US.

https://www.amazon.com/gp/customer-reviews/R1GN9BTTWQZK3P/re... https://www.amazon.com/gp/customer-reviews/R2NX523G3R0CZ8/re...

Since those reviews were posted, Wyze has actually enabled support for RTSP, which would address some of the issues those reviews mentioned. I haven't tested it out myself, but it seems to be working for a lot of people. I'm not sure if it still attempts to send data back to its own mothership though.

How does RTSP solve the privacy problem of potentially sending user information to another country?

After initial sideloading of the new firmware (unsupported IIRC, you're on your own), you can grab the RTSP credentials and disconnect the camera entirely. It is usable as an offline IP camera after that. No cloud, just give it LAN access only.

Before this there was no non-proprietary way to access.

RTSP has nothing to do with privacy. It's just another way to schlep streaming media around the internet.

They may have also stopped sending data back to their own servers, but that's completely orthogonal.

How is that different from all the products that send customer information to the US?

I guess maybe we USians don't want to send intel to a country that doesn't necessarily have our best interest at heart.

Well, non USians like me don’t really have a choice

Yes, that's a fair point. The same concern would apply.

Wyze also downloads crap tons of something.

1 of my wyze downloaded 350 MB while uploaded 5 GB

Another downloaded 2.5 GB while uploaded 150 GB - Always on RTSP.

Reply on news.ycombinator.com