The Impending Doom of Expiring Root CAs and Legacy Clients

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by briffle on Monday June 08, 2020 @09:53AM (#23456476)

I never hooked up the smart tv to my wireless network. I have heard too many stories about data getting sent back to the manufacturers to sell your watching habits, etc. Instead, I use a Roku, that I know gets updates (and yes, they also sell your watching habits, but so far, nextdns.io's lists block the DNS that roku uses to do this.)

[ Parent | on HN ]

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by 1bc29b36f623ba8 on Monday June 08, 2020 @11:03AM (#23457091)

I have a dummy hotspot with no access to anything whatsoever, and which I allow my TV to connect to. Apart from exposing an undocumented API (with code execution capabilities), and allowing logging in as root over Telnet (without a password), it also tries to fetch software updates over plain HTTP. It's a bloody nightmare.

On the plus side, it was possible to disable many of the smart features once I discovered the telnet capability. :D

[ Parent | on HN ]

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by gindely on Monday June 08, 2020 @11:44AM (#23457558)

Vulnerabilities are a massive trade off. I want my devices to be open to me, not to anyone. Seems like it should be straight forward to give you access to the device (like "scan this qrcode on the inside of this panel" and you get the private key). One can dream...

[ Parent | on HN ]

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by 1bc29b36f623ba8 on Tuesday June 09, 2020 @02:20AM (#23464218)

Yeah, pretty much every single "smart" device I've ever bought has had vulnerabilities that never got patched. It's ridiculous.

On the plus side, my 10 year-old laptop still finds a use as an access point/firewall for all those things. :D

[ Parent | on HN ]

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by daemin on Tuesday June 09, 2020 @06:12AM (#23465273)

Does anyone know of such hacking that someone has done and documented? I'd be interested in trying to telnet or connect to a Samsung TV that I have, or at least be able to sandbox it somehow.

[ Parent | on HN ]

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by dathinab on Monday June 08, 2020 @10:14AM (#23456623)

Problem some do connect to any non secured WiFi they can find.

[ Parent | on HN ]

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by katbyte on Monday June 08, 2020 @10:20AM (#23456683)

I purposely bought and expensive one that’s pure android tv where you can disable all the tracking bits

[ Parent | on HN ]

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by jannes on Monday June 08, 2020 @10:33AM (#23456805)

You bought an Android device to avoid tracking? lol

As long as you're using binaries that were compiled by Google I wouldn't trust them one bit.

If you use LineageOS on your TV you might be a little better off.

[ Parent | on HN ]

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by katbyte on Saturday June 13, 2020 @03:31PM (#23512011)

Android by Sony verses Samsung or webos? I’m happy with my choice.

[ Parent | on HN ]

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by vardump on Monday June 08, 2020 @11:56AM (#23457707)

Just remove the antenna? Won't be connecting very far after that!

[ Parent | on HN ]

Re:The Impending Doom of Expiring Root CAs and Legacy Clients by briffle on Monday June 08, 2020 @10:23AM (#23456713)

That is terrifying.. good to know!

[ Parent | on HN ]