<story><title>Reverse-Engineering Google Nest Devices</title><url>http://experimental-platform.tumblr.com/post/137835649425/reverse-engineering-google-nest-devices</url></story><parent_chain></parent_chain><comment><author>Animats</author><text>Then there are the Nest cameras, reporting everything you do to Google.&lt;p&gt;&lt;i&gt;&amp;quot;The telescreen received and transmitted simultaneously. Any sound that Winston made, above the level of a very low whisper, would be picked up by it; moreover, so long as he remained within the field of vision which the metal plate commanded, he could be seen as well as heard. There was of course no way of knowing whether you were being watched at any given moment. How often, or on what system, the Thought Police plugged in on any individual wire was guesswork. It was even conceivable that they watched everybody all the time. but at any rate they could plug in your wire whenever they wanted to. You have to live - did live, from habit that became instinct - in the assumption that every sound you made was overheard, and, except in darkness, every movement scrutinized.&lt;/i&gt;&amp;quot; - &amp;quot;1984&amp;quot;, Orwell&lt;p&gt;&lt;i&gt;&amp;quot;Video and audio signals and data: When you enable the recording or streaming features of your Nest Cam, we may record and process video and&amp;#x2F;or audio recordings from the device, subject to your configuration and settings. This may include capturing and emailing to you portions of this data as part of a notification or analyzing the data to identify motion or other events. We may process information from your Nest Cam so that we can send you alerts when something happens. In addition, if you have the recording features enabled, we will capture, process and retain video and audio data recordings from your device for the duration of your recording subscription period (for example, 10 or 30 days) and you will be able to access those recordings using the Services during that time.&amp;quot;&lt;/i&gt; - NestCam privacy policy, Google</text></comment>
<story><title>Reverse-Engineering Google Nest Devices</title><url>http://experimental-platform.tumblr.com/post/137835649425/reverse-engineering-google-nest-devices</url></story><parent_chain></parent_chain><comment><author>pilif</author><text>&lt;i&gt;&amp;gt; with email and plaintext password&lt;/i&gt;&lt;p&gt;It&amp;#x27;s totally reasonable to transmit a password in clear if it&amp;#x27;s being transmitted inside of an SSL tunnel (which it is in this case).&lt;p&gt;Most if not all techniques that would allow for not transmitting the password in a server-decryptable fashion would require the password or a password equivalent to be stored in clear on the server.&lt;p&gt;In case of a breach, that would be devastating.</text></comment>