Ask HN: Is it reasonable to cover your webCam?
I am not a programer, but my impression from various journalists and so forth is that webCams are relatively vulnerable to hijacking. My impression is that once an adversary has access to a webcam, they probably has access to basically everything else. Is this true?
The reason I ask is because I 3D printed a pretty good cover which I am attempting to sell , but I can't convince anyone that its worth using. Maybe they're right. Let me know.
www.hidemyeye.com
82 comments
[ 3.1 ms ] story [ 144 ms ] threadMy former corp physically removed all webcams from laptops.
I know a lot paranoid about them. Mic too.
You could probably even market stickers like that specifically for the purpose of covering cameras. Designed to not leave adhesive behind when removed (like the adhesive on post-its), and perhaps even given a shiny black finish that matches common laptop screen frames.
Personally, I've never seen a need for covering my webcam through some combination of just not caring if some remote entity is watching me type, and assuming that the risk of my webcam being activated without the little light going on is pretty low.
But, if I was offered a cheap well-designed sticker made for the purpose of covering my webcam I'd probably buy a pack.
Better: labeling to state that the device is explicitly equipped against unwarranted surveillance. The message of avoiding surveillance might be more useful than the act of frustrating it.
I'd prefer a more robust mode of disabling the camera myself. For an external cam, powering it off would be my first preference.
http://www.theguardian.com/world/2014/feb/27/gchq-nsa-webcam...
http://www.reddit.com/r/worldnews/comments/1z33wx/uk_spy_age...
http://blog.erratasec.com/2013/12/how-to-disable-webcam-ligh...
Lights are frequently software controlled, as implied by the sibling comment to this one.
Really? Fear-mongering at it's finest.
I don't bother with it personally, although I've seen many people that do put a sticker/bit of tape over it.
One more thing, your landing page isn't really the best. I like the animation of the product in action, but the Instagram-esque filter doesn't look professional at all. Your first paragraph is a full anchor link, and your other paragraphs are broken at random lines which really kills the reading experience. The photo, which I presume is a webcam shot with the product blocker on, isn't actually described at all.
Remember that a hibernating system is actually in a low power state, but there's still some draw. This means that specific processes might be running.
Baseboard / preboot / bootloader and other execution environments, including even running within the firmware of specific peripherals, is a concern I've been aware of since ~2005, from people who are taken exceptionally seriously in the security community. Context was a presentation following an RSA conference and Intel's plans at the time for extensive baseboard/preboot environments (which have largely failed to take hold on consumer hardware, though many/most server systems now have same).
Do I think the risk is high? No. But it's nonzero.
Not the original quote. The quote was "even if your device is turned off", which I take to mean 'shutdown -h now'. Nowhere is hibernation mentioned.
If your EFI/preboot environment is rooted by a three letter agency you have more problems than someone getting your picture.
I do suspect that running a camera would generate sufficient power draw that you'd tend to notice, though hibernating and taking periodic snapshots might be much harder to detect.
For the casual user, distinguishing a down-disabled device from one that's got a slight charge trickling through it, especially if it happens to be connected to a charger, is going to be easy to get wrong.
Remember those stickers from the 90s, "Big Brother Inside" with the intel look-alike logo? Think along those lines.
This means if it starts walking, you know it's yours. And the potential walker is likely to realize you'll be able to ID the device quickly.
I could see that being an uphill battle since a Post-It would work, is free, and is less likely to make most feel like they might be judged as a paranoiac ... or conspicuously like they have something sufficiently unusual to hide that they need to purchase something that most people don't. (Not saying that makes logical sense, just that it makes "marketing sense".)
If I sit in front of a laptop with a black camera against a grey/metal bezel, though, I think about it constantly.
Humans. Weird.
1) Every laptop has a microphone built in that doesn't have an indicator light that you'd have to bypass to surreptitiously record audio. I think that, as far as invasion of privacy/corporate espionage goes, this is scarier than the webcam (which in my case, if someone were to hack it, would be hours of me simply staring into the screen, as my laptop is usually closed when I'm not using it).
2) You should try charging more than $3. To me that's so cheap as to inspire some questions about its quality. At least $5, perhaps $10 would make it seem more legitimate.
This is why people are talking about physically covering their web cams. What software can disable, software can enable, so this problem can't be solved by software. No about of FBI software can give your camera the ability to see through solid objects however.
Some have it software controlled (either firmware or driver).
The first ones are pretty safe since you know when they're in use and the notification is mostly unbypassable.
The other thing is that one rarely get interesting data through the webcam thus access to the webcam is generally no something people are looking for when running large scale attacks (for targetted attacks this is different).
Also... a piece of tape is nicer, lighter, more convenient and infinitely cheaper than a 3d printed shape :/
""The FBI has been able to covertly activate a computer’s camera — without triggering the light that lets users know it is recording — for several years, and has used that technique mainly in terrorism cases or the most serious criminal investigations, said Marcus Thomas, former assistant director of the FBI’s Operational Technology Division in Quantico, now on the advisory board of Subsentio, a firm that helps telecommunications carriers comply with federal wiretap statutes. ""
Good times. http://www.washingtonpost.com/business/technology/2013/12/06...
Well, no - i was pretty impressed when i read the writeup of a few researchers who where able to circumvent even the LEDs that are dongled into a current path.
https://jscholarship.library.jhu.edu/bitstream/handle/1774.2...
We already have ransom-where, why not blackmail-ware?
That said, from a design perspective, I'd very much prefer that devices (laptops, desktops, tablets, phones, monitors, etc.) offered:
1. Hardware indicators of activation of media inputs: camera, microphones, etc.
2. Physical covers or switches to activate/deactivate these. My Thinkpad has a physical switch to activate the WiFi transmitter, but there's no shutter for the camera (I've seen slider doors on some devices), nor can the mic circuits be toggled by a physical control (though I can set my mixer settings via software).
Edit: But see comments elsewhere: stickers which explicitly convey a message about security/privacy and cover lenses could be an interesting angle. Much lower cost, fad/awareness appeal. Possibly even a tie-in with privacy groups (e.g., EFF, etc.). Good schwag.
On the topic of webcam covering: I agree with others that a separate cover is overly complex of a solution for such a simple problem: a sticker or other opaque material will suffice to block the lens effectively on computers that have integrated non-removable cameras. For a removable webcam, the simplest and safest solution is to unplug it, or if that is inconvenient, aim it at something of little interest like a blank wall.
Fun fact: when I bought a hard drive for my computer (one of those old MFM 20 MB drives, it was the late eighties), I found it very noisy. The hard drive was internal, so I engineered a physical on-off switch by routing its power input through the otherwise unused turbo switch (remember those?) that was on my computer case. When I wanted to write in peace, I would turn the drive off, before turning the computer on, and boot from a floppy disk. I just had to be careful not to turn the drive off when it was already spinning, and I never did.
So this kind of time delay in games and other software was common practice. When processors did start getting significantly faster, some games became unplayable or bugged out altogether.
Along came the turbo button: it didn't actually make your computer faster, it made it slower. Because of the confusing name, the turbo button was usually rigged so that you would leave it on by default -- using your processor's manufactured clock speed -- but if you wanted to play an older game that relied on processor speed for delay timing, you would deactivate the turbo, slowing your system clock speed down to something that matched older hardware.
Back in the 1990s I could run that on my Pentium 180 Mhz system.
Trying again ~10 years later I found that lunar gravity had increased markedly since ;-)
I find that the fact that someone's already pursued an idea tends to suggest it's at least worthwhile to do.
https://supporters.eff.org/shop/laptop-camera-cover-set
So there's some competition in the space.
So the market's valid, which is good. ;) Perhaps there's a place for something less disposable?
Once OP's product becomes popular it would help EFF more in the long run, too—raising public awareness about potential privacy issues with personal tech.
People who almost never use their webcam would probably prefer a sticker.
Most people don't seem to care about this. Your job is not to convince everyone that they should, but to get your product in front of the people who already do.
Source: http://www.ringit.com.au/blog/taping-over-prying-eyes-of-web...