Zack Whittaker* says smart camera maker, Ring, has not done enough to mitigate the most basic security problem with its products.
On the same day that a Mississippi family was suing Amazon-owned smart camera maker Ring for not doing enough to prevent hackers from spying on their kids, the company rolled out its previously announced “control centre”, which it hopes will make you forget about its verifiably “awful” security practices.
In a blog post at the end of January, Ring said the new control centre “empowers” customers to manage their security and privacy settings.
Ring users can check to see if they’ve enabled two-factor authentication, add and remove users from the account, see which third-party services can access their Ring cameras and opt-out of allowing police to access their video recordings without the user’s consent.
But dig deeper and Ring’s latest changes still do practically nothing to change some of its most basic, yet highly criticised security practices.
Questions were raised over these practices months ago after hackers were caught breaking into Ring cameras and remotely watching and speaking to small children.
The hackers were using previously compromised email addresses and passwords — a technique known as credential stuffing — to break into the accounts.
Some of those credentials, many of which were simple and easy to guess, were later published on the Dark Web.
Yet, Ring still has not done anything to mitigate this most basic security problem.
TechCrunch ran several passwords through Ring’s sign-up page and found we could enter any easy to guess password, like “12345678” and “password” — which have consistently ranked as some of the most common passwords for several years running.
To combat the problem, Ring said at the time users should enable two-factor authentication, a security feature that adds an additional check to prevent account breaches like password spraying, where hackers use a list of common passwords in an effort to brute force their way into accounts.
But Ring still uses a weak form of two-factor authentication, sending you a code by text message.
Text messages are not secure and can be compromised through interception and SIM swapping attacks.
Experts say although text-based two-factor is better than not using it at all, it’s far less secure than app-based two-factor, where codes are delivered over an encrypted connection to an app on your phone.
Ring said it will make its two-factor authentication feature mandatory later this year, but has yet to say if it will ever support app-based two-factor authentication in the future.
The smart camera maker has also faced criticism for its cosy relationship with law enforcement, which has lawmakers concerned and demanding answers.
Ring allows US police access to users’ videos without a subpoena or a warrant.
(Unlike its parent company Amazon, Ring still does not publish the number of times police demand access to customer videos, with or without a legal request.)
Ring now says its control centre will allow users to decide if police can access their videos or not.
But don’t be fooled by Ring’s promise that police “cannot see your video recordings unless you explicitly choose to share them by responding to a specific video request”.
Police can still get a search warrant or a court order to obtain your videos, which isn’t particularly difficult if police can show there’s reasonable grounds that it may contain evidence — such as video footage — of a crime.
There’s nothing stopping Ring, or any other smart home maker, from offering a zero-knowledge approach to customer data, where only the user has the encryption keys to access their data.
Ring cutting itself (and everyone else) out of the loop would be the only meaningful thing it could do if it truly cares about its users’ security and privacy.
The company would have to decide if the trade-off is worth it — true privacy for its users versus losing out on access to user data, which would effectively kill its ongoing cooperation with police departments.
Ring says that security and privacy have “always been our top priority”.
But if it’s not willing to work on the basics, its words are little more than empty promises.
* Zack Whittaker is Security Editor at TechCrunch. He tweets at @zackwhittaker.
This article first appeared at techcrunch.com.
