Dell’s latest Latitude business laptops add an automated webcam shutter | Hacker News Reader

Dell’s latest Latitude business laptops add an automated webcam shutter

theverge.com

28 pointsTomte40 comments

I'd personally prefer a manual shutter like the one Lenovo includes on its newer machines. It's nigh impossible for an attacker to open that against my will without physically reaching over my shoulder and moving the slider.

Right? I was about to post this exact same thing. It seems like automating the shutter control kind of kills the entire point of having a shutter: a solid manual control of the usage of the camera. I guess it is a bit better than just an LED as at least you can look at it and know its open or closed (can't trust the LED to always light) but nothing is preventing it from opening up when you're not paying attention, grabbing a quick picture, and closing back up before you notice.

>can't trust the LED to always light

You can on recent Macs. If the LED fails the webcam won't work.

But an indicator is not a control.

Remember the school district that was spying on the kids using apple laptops? Only one or two kids noticed "hey, the light blinked for a second".

But will you notice if the webcam captures one frame and the led flashes for 1/60th of a second?

Yeah, it lags like a second between when the light goes on and when the camera turns on.

Exactly! At best you'd hear it snap open and closed, but the point would still be defeated.

What's with all the people being so paranoid about the camera?

The person who has access to your computer has access to everything else but the camera. Your purchase history, porn you watched, messages. Are you trying to say that out of all of that the video is the worst offender in your life?

Just because you have access to the camera doesn’t mean you have access to all those other things. The exploiter could still be sandboxed within a browser tab or specific application container.

And just because people are paranoid about the camera doesn’t mean they aren’t also paranoid about those other things.

> has access to everything else

Everything else _that's on my computer_.

The person with access to my camera has access to observe the environment my computer is in. My WFH setup is in my bedroom - I don't want to be paranoid that my company (or a random IT employee at my company) can use my computer as an incognito candid camera at a whim by remotely activating it and suppressing any visible indications that it's activated.

Manual shutters ensure that you definitively know if it's even _capable_ of viewing/recording you. Automated shutters at least can provide re-assurance at a glance if it's active (or capable of being activated) at that point in time. An indicator light that may or may not be capable of being manually suppressed means you have no reassurance at all about whether you're being visually observed any time your laptop is open and powered on, which can be stressful.

I can shut it and turn it off at night when I'm not working to provide reassurance that it can't record me when I'm not working, but my room is a shared space where there are plenty of things that happen in it while I _am_ working that I wouldn't want captured, such as my SO in bed behind me if I start work before she gets up, or her coming in to change during the day or get dressed after a bath/shower.

The abrupt shift to WFH over the past year is likely one of the drivers of it being such a hot trend for business laptops. Many people I know and work with have don't have dedicated home offices, and have similarly resorted to repurposing shared spaces to work from (bedrooms, dining rooms, living rooms, etc), and likely have similar concerns about maintaining their personal privacy as much as possible.

There was the case (in Pennsylvania IIRC) of a remote admin actually engaging the camera remotely on school-district owned laptops located in minor students' homes. You could imagine that those minors had an absolute right to privacy in their homes and might not have much of anything secret or private on those laptops.

I think it's more about preventing user error. It's easy for legitimate apps to suddenly start recording on laptops/desktops when you're not expecting it.

One example is when you're waiting for a video conference to begin, you don't want the camera to suddenly turn on when you're not ready for it.

I like there to be an explicit action before I allow recording. For smartphones there's a permission model where I have the ability to explicitly grant permission every time an app wants to turn on the camera.

However such a stringent permission model doesn't exist on desktops/laptops, so a slider is a simple low-tech solution to the absence of a sufficient software permission model.

I think that seeing what I am doing is more invasive than seeing what I have done. However it is a strange point to think over.

Someone being able to remotely turn on my camera anytime during the day or night to spy on and record my family is much more concerning to me than them getting my purchase history.

Without the camera, they don't have access to videos of me enjoying myself to the aforementioned porn.

I believe this:

- is more common than people believe

- has actually hurt people

I feel this is a feature added by request from someone that misses the point of (manual) shutters, likely from the same group of people who would request allowing to disable the camera's LED indicator. (And Dell engineers cannot deny the request because the management say so.)

I bet you the engineer who designed this (1) knows it's silly and (2) reads HN. I wonder if we'll get the story!

I would rate it more likely that this idea was the result of a brainstorm about ideas on how to monetize on (the feeling of) privacy.

A bit similar to the whole connected fridge idea.

A: "We need features to distinguish ourselves from our competition"

B: "Touch screens are definitely a thing these days. And I can use my laptop to order groceries"

And suddenly every fridge from the future had a touch screen without considering the core thing the fridge does. Freezing things.

It would have been a great feature if this were an integrated manual shutter.

I think you have missed the hidden point of my comment (well, it is sarcasm though so apologies to that).

I get that (1) there are UX design features that it was missed, and (2) there are people who want to be able to spy on people through the webcam without any indication that they are being spied upon and (3) try to sell it as a feature, (4) spying could be for the purpose of remote monitoring employees during these times of pandemic-forced remote working (5) or something more nafarious with state-level actors.

Was there something I missed?

Yes, that my statement tells about some "boss" (CEO or VP of some company) who doesn't want to be instructed by IT to slide the "stupid" (in their own opinion) cover and wants it to be automated, in the same way that they complain about the "stupid" (again in their own opinion) LED indicator light and wants it to turn off. It's not totally about spying (surpringly some don't have that concern at all) and more about that some people don't see the point about the cover the same way that they don't also see the point about the LED indicator and wants to have a "fix" (even though the fix is disingenuous to those who understands the reasoning behind it). Of course, Dell will lose their business with that company with that boss because the boss wants to have that fancy shutter and will switch if this condition was not met.

I don't want to explain my sarcasm but I understand that some people may not get it and I apologise again for the inherent non-clarity of my first statement.

I thought I had that covered in my point (1).

What's the point of an automatic shutter? It seems like security theater, unless the goal is to protect the camera lens from dirt and scratches.

I know a few people who put tape over their camera so I can see some market for this. One friend in particular had an ex install some sort of remote access software on her laptop which he used to access her webcam.

Personally I like to think I'm careful about who has access to my hardware and I trust the webcam light. Theoretically someone might be able to hack the firmware but if I was being directly targeted by a sufficiently capable and motivated actor my webcam would not be my biggest concern.

What? If it's automated, just turn the camera off. If you can access the camera, you can access an automated shutter, no?

Seriously, what's the point of having an automated shutter?

Automated software-controlled shutter is useful. Attacker can’t record without engaging the shutter. Engaging the shutter outs the attacker.

(Contrast with software-controlled LED indicators: attacker can record undetected if they manage to bypass the LED.)

A manual shutter covers still more attack vectors, but automated shutter is better than no shutter.

This is a good point, but a hardwired LED does the same thing without creating a point of failure, no?

Except that the LED is usually not hardwired, but controlled by another microcontroller, which gets an on/off message from the camera micro, which is connected via USB as a UVC device. The LED is often directly controllable via the UVC interface.

> Anyone who’s ever stuck a sliding shutter or taped over their webcam for security concerns should be able to see the benefit of an automatic, integrated setup here, and it’s something that will hopefully extend to other laptops in Dell’s lineup in the future.

I expected better understanding of the potential security issues with an electronic shutter from a "tech" website.

Pretty much. All laptop webcams already have shutoff features to save power. Its just a question of trust.

I would only trust something I can move with my own finger.

My Dell Precision laptop has a manual camera shutter. This seems like a step backwards.

Same (different line)

I thought it was a great design detail when I got the laptop too

>automated

I mean, it's better than nothing, and I suppose you can see whether it's open or closed. But having it automated is an odd choice--it's more expensive and less effective from a privacy standpoint.

What about audio? If a hacker activates your webcam but it's visually blocked by tape or whatever, isn't it still capturing audio?

If you care about it, consider Purism laptops with a hardware kill switch for camera/audio: https://puri.sm/products.

You could have a no-moving-parts version by putting an LCD window in front of the camera that visibly blacks out. Paging Apple.

It would be a fun hack to pwm it so that it looks dark but still lets enough light through to capture an image.

Reply on news.ycombinator.com