HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD
you are viewing a single comment's thread
view the rest of the comments
[–] 15 points 1 week ago (2 children)

Ethically? Expire the token since it's compromised, and offer to refurbish all units in the field since flock screwed up, a now all customer data could be poisoned/suspect now.

Realistically? Keep going like nothing happened an make it a customer support problem while pushing new hardened cameras that cost more. Because the product alone loudly flags Flock as a bunch of amoral greedy fuckwits.

I won't suggest ways to actually make their product bulletproof because I care and we don't need to make this problem worse for everyone. It is a tantilizing problem space but there are never any perfect answers in security, only relatively better/worse ones.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 1 week ago (1 child)

    Oh, I don't mean afterwards. I meant before it even happened.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 week ago

    You give each camera its own token, and validate it with hardware ID.

    Even better, give them hardware token, that can sign, but does not leak its keys.

    In either way, you can ID the device, and block unsold and confirmed stolen/damaged ones. And never accept traffic from anything else.

  • source
  • parent