Re:A vigilante trying to improve IoT security
by 086421357909764 on Thursday April 27, 2017 @10:36AM
(#14211766)
Ok, lets switch this around. You just rented your new apartment, they didn't change the locks from previous tenant. Now, by default everyone knows you should change locks to include the owner, manager of property, and renter. I, the previous tenant decided to stroll by the house one day, I realize that the doors are still easily unlocked by my key, so I walk in and poke around. Realizing that this is a security risk, so following your logic, it's completely sane for me to destroy the house and prove that it's a risk. Before you say, that's different, MFG will replace a device, i'm going to argue ok sure, they'll replace it, by that same virtue isn't that what insurance is for? They'll replace the property.
Bottom line, vigilantism has a cost and picking and choosing morality of ideals based on your sole opinion is neither appropriate or legal. laws exist for a reason.
I'd say you are changing topics. The topic at hand is about devices that are designed to be insecure, because the involved parties just don't care. The manufacturer KNOWS yet doesn't care because the issue doesn't cause him any harm, and the user just doesn't know.
We are talking about devices that willingly expose themselves to the internet (oftentimes without any valid reason to), that are all factory-setup with the same credentials (and no must-change on first use policy), etc.. This is just malpractice, not 0-day vulnerabilities.