Is that the token?

Ah yes, yes it is.

I wonder if that means you could “claim” a bunch of MAC addresses so you can block deployment of new or replacement flock cameras.

And it doesn't have to be a camera. It can just be a random set of images.

You're right, but Flock (and all of these cameras) is bad for the liberty of the people, so this is good. Any time a national security threat is found, it shakes the trust in these systems, so they're less likely to be trusted again.

don't look surprised when someone in a hockey mask cuts your legs off at the knees with a chainsaw.

🎶 When you get knocked down, don't you get up again. We're all trying to keep you down.

damn that's good

So you're wearing Meta glasses?

I'd like to live in a world in which the former is the case, but as an engineer I have seen some shit

Hanlon's razor:

Never attribute to malice that which is adequately explained by stupidity.

But, also, Grey's law:

Any sufficiently advanced incompetence is indistinguishable from malice.

Ethically? Expire the token since it's compromised, and offer to refurbish all units in the field since flock screwed up, a now all customer data could be poisoned/suspect now.

Realistically? Keep going like nothing happened an make it a customer support problem while pushing new hardened cameras that cost more. Because the product alone loudly flags Flock as a bunch of amoral greedy fuckwits.

I won't suggest ways to actually make their product bulletproof because I care and we don't need to make this problem worse for everyone. It is a tantilizing problem space but there are never any perfect answers in security, only relatively better/worse ones.

One way would be to generate a unique private key on the secure element / TPM and its public key stored on the server for validation. Each API request would need to be signed with a relatively short expiration time. That way the code never contains sensitive content such as an API key, an exploited device only holds in RAM a signed certificate that is valid for a short period of time, and the certificate can be revoked/blocklisted on the server if compromised.

y'all just givin the work away huh? don't answer this unless you are getting paid.