News for hackers. Stuff that matters.

A comment on CloudPets teddy bears leaked and ransomed, exposing kids' voice messages. Parent comment

Re:CloudPets teddy bears leaked and ransomed, exposing kids'... by conradev on Tuesday February 28, 2017 @02:15AM (#13751925)
I like Apple's approach, where HomeKit certification requires that the device use some form of secure transport to communicate with iOS.
[ Parent | on HN ]
Re:CloudPets teddy bears leaked and ransomed, exposing kids'... by Xylakant on Tuesday February 28, 2017 @05:37AM (#13752744)
Which totally would not have helped in this case: using https would still have left the DB exposed.
[ Parent | on HN ]
Re:CloudPets teddy bears leaked and ransomed, exposing kids'... by po on Tuesday February 28, 2017 @06:18AM (#13752913)
It doesn't help the server side data leak but at least you can't connect to it and make it say 'destroy all humans'
[ Parent | on HN ]
Re:CloudPets teddy bears leaked and ransomed, exposing kids'... by Xylakant on Tuesday February 28, 2017 @08:23AM (#13753510)
That's not necessarily the case. TLS protects the connection, but by default does not provide authentication. I also see a lot of instances where certificate checking has been disabled, so that the client just ignores a MitM attack. So with TLS it would seem more secure at first glance, but given the implementation blunders here I wouldn't expect any real improvement.
[ Parent | on HN ]
Re:CloudPets teddy bears leaked and ransomed, exposing kids'... by po on Wednesday March 01, 2017 @07:50PM (#13770336)
Yeah that's true, I'm totally assuming 'competently implemented TLS' when I say it would protect the connection.
[ Parent | on HN ]