• chevron_right

      Maison connectée et fuite de donnée, une relation qui fonctionne

      news.movim.eu / Korben · Monday, 1 July - 08:00 · 5 minutes

    Maison autonome et écologique DIY

    — Article en partenariat avec Surfshark VPN

    Comment ça va de votre côté ? On se prépare doucement à la pause estivale ? En ce qui me concerne, j’en termine déjà avec le premier mois de mon trimestre de pause … ça file à une vitesse ma bonne dame, c’est dingue ! Mais s’il y en a qui ne prennent jamais de repos, ce sont bien les espions à l’affut de nos données.

    Au travers de mes précédents articles, j’ai déjà fait le tour de pas mal d’outils, objets et services qui nous surveillent en quasi permanence. Les voitures intelligentes par exemple, ou les applications d’IA ainsi que celles dédiées au shopping . Bref tout ce qui stocke de la data personnelle est susceptible de fuiter ou d’être utilisé à vos dépens et sans votre autorisation. Le plus souvent c’est « seulement » pour vous bombarder de pubs ciblées, mais parfois c’est plus dangereux que cela (escroquerie, vol d’identité …). Et comme je l’ai montré dans ces mêmes articles, cela arrive de plus en plus fréquemment, la data numérique étant la nouvelle manne financière d’un pan entier du web.

    Aujourd’hui on va s’intéresser à quelque chose d’autre : les maisons intelligentes . Car vous le savez aussi bien que moi, nous avons de plus en plus d’objets du quotidien connecté via des applications (IoT). Quelques exemples ? Brosse à dents, montre connectée, aspirateur robot, porte de garage, système de surveillance, machine à café, frigo, système de chauffage ou d’éclairage, volets de fenêtres ou encore les classiques assistant virtuel type Alexa. Alexa qui fête déjà ses 10 ans cette année, le temps passe vite ma bonne dame ! (je sais, je me répète, c’est l’âge … le temps passe vite ma …).

    Surfshark nous a pondu une étude sur la question et épingle notamment Google et Amazon comme les plus avides de nos données (quelle surprise Sherlock). Mais ils ne sont pas les seuls puisque la majorité des quasi 300 applis testées récoltent et stockent diverses infos comme vos noms, votre email, vos interactions avec le produit (heures & Co) ou encore votre localisation précise. Infos qui vont aller gonfler nos profils chez les centaines de courtiers en données dès qu’elles se retrouveront dans la nature.

    Amazon Alexa est de loin la pire de toutes, collectant 28 données différentes sur 32 analysées … qui, en plus, sont directement liées à votre identité personnelle. Au calme. Google fait un peu mieux, avec « seulement » 22 données récupérées (adresse, photos et vidéos, données de santé …). L’une des catégories les plus touchées ce sont les caméras de sécurité … qui ne font donc pas que surveiller les voleurs, mais les habitants de la maison eux-mêmes. On a aussi dans la liste des jouets connectés pour enfants (décidément après les applis mobiles pour gamins , ils ne sont jamais tranquilles nos mouflets). Vous pouvez retrouver tout le détail de l’étude sur cette page , si vous voulez creuser un peu par vous-mêmes.

    Bon vous allez me dire, en quoi est-ce problématique ? Je n’ai rien à cacher ! (hahaha … OK boomer). Ces gadgets collectent vos données, augmentant ainsi votre empreinte digitale, et parfois utilisent ces mêmes données pour afficher des publicités ciblées. Chiant, mais pas mortel. Au niveau de la sécurité, le risque de mauvaise gestion ou de fuites de données augmente, car les données sont distribuées à travers plusieurs bases de données. Qui finiront pas fuiter, se faire hacker ou être revendues à des datas brokers. Ce qui arrive quotidiennement.

    Prenons un exemple concret : vous avez installé une caméra de sécurité pour filmer si quelqu’un entre par effraction chez vous. Jusque là rien de spécial. Mais si cette caméra vous enregistre vous en train de tondre votre pelouse à moitié à poil et que la vidéo finit dans les mains d’un hacker quelconque … là c’est une autre histoire. Imaginez l’intimité du chef de l’Internet révélée aux yeux du grand public. Le monde n’est pas prêt.

    Maintenant, comment lutter contre ce fléau ? Et bien déjà en se posant la question de savoir si l’on a vraiment besoin de ce type de gadget. La caméra si vous êtes dans une zone à risque ça peut avoir du sens. La brosse à dents ou la machine à café connectée … ce n’est peut-être pas vital. Ou au moins, essayez de trouver une alternative open source (pour creuser le code et voir comment elle fonctionne vraiment) et moins avide de tout savoir sur vos habitudes.

    Prenez également le temps de mettre à jour les paramètres pour limiter au strict minimum ce que vous partagez. Si votre aspirateur robot a besoin du microphone ou que votre air fryer dispose d’un accès caméra, posez-vous des questions ^^ Pensez aussi à sécuriser vos connexions Wi-Fi et chiffrer tout votre trafic. C’est là que va intervenir Surfshark, l’un des plus réputés du marché que je vous recommande depuis des années. Il vous évitera de voir vos flux de données interceptés par un tiers, ou tout du moins de les rendre inexploitables si cela devait arriver. Je ne vous refais pas la présentation des multiples intérêts de l’outil, je l’ai déjà fait dans ma présentation de Surfshark VPN .

    Surtout que vous pouvez en bénéficier au prix d’environ 71€ pour 27 mois (moins de 2.65€/mois) avec l’abonnement 2 ans. Ou opter pour la boite à outils complète Surfshark One (avec l’antivirus, la surveillance de fuites & co) pour à peine plus cher (3.23€/mois). Pas cher payé le prix de tranquillité d’esprit.

    Testez le VPN de Surfshark !

    • chevron_right

      Oral-B bricking Alexa toothbrush is cautionary tale against buzzy tech

      news.movim.eu / ArsTechnica · Wednesday, 5 June - 20:09

    Oral-B released the Guide in 2020, making promises of Alexa-powered convenience, which it ended in 2022.

    Enlarge / Oral-B released the Guide in 2020, making promises of Alexa-powered convenience, which it ended in 2022. (credit: P&G)

    As we’re currently seeing with AI , when a new technology becomes buzzy, companies will do almost anything to cram that tech into their products. Trends fade, however, and corporate priorities shift—resulting in bricked gadgets and buyer's remorse.

    That’s what's happening to some who bought into Oral-B toothbrushes with Amazon Alexa built in. Oral-B released the Guide for $230 in August 2020 but bricked the ability to set up or reconfigure Alexa on the product this February. As of this writing, the Guide is still available through a third-party Amazon seller.

    The Guide toothbrush's charging base was able to connect to the Internet and work like an Alexa speaker that you could speak to and from which Alexa could respond. Owners could “ask to play music, hear the news, check weather, control smart home devices, and even order more brush heads by saying, ‘Alexa, order Oral-B brush head replacements,'” per Procter & Gamble's 2020 announcement.

    Read 14 remaining paragraphs | Comments

    • chevron_right

      How I upgraded my water heater and discovered how bad smart home security can be

      news.movim.eu / ArsTechnica · Friday, 17 May - 11:00 · 1 minute

    The bottom half of a tankless water heater, with lots of pipes connected, in a tight space

    Enlarge / This is essentially the kind of water heater the author has hooked up, minus the Wi-Fi module that led him down a rabbit hole. Also, not 140-degrees F—yikes. (credit: Getty Images)

    The hot water took too long to come out of the tap. That is what I was trying to solve. I did not intend to discover that, for a while there, water heaters like mine may have been open to anybody. That, with some API tinkering and an email address, a bad actor could possibly set its temperature or make it run constantly. That’s just how it happened.

    Let’s take a step back. My wife and I moved into a new home last year. It had a Rinnai tankless water heater tucked into a utility closet in the garage. The builder and home inspector didn't say much about it, just to run a yearly cleaning cycle on it.

    Because it doesn’t keep a big tank of water heated and ready to be delivered to any house tap, tankless water heaters save energy—up to 34 percent, according to the Department of Energy . But they're also, by default, slower. Opening a tap triggers the exchanger, heats up the water (with natural gas, in my case), and the device has to push it through the line to where it's needed.

    Read 38 remaining paragraphs | Comments

    • chevron_right

      Spring Refresh With Govee Floor Lamps: The Ultimate Guide

      Slixfeed · Monday, 13 May - 11:00 edit


    Calling all smart home enthusiasts and home decor lovers! Govee has introduced a couple of new models to its Govee Floor Lamp Series. They are designed to blend into your lifestyle with all the convenience and ambiance the company is renowned for.

    • chevron_right

      Connected devices with awful default passwords now illegal in UK

      news.movim.eu / ArsTechnica · Monday, 29 April - 19:45 · 1 minute

    A group of Black Friday online shopping purchases photographed in delivery boxes filled with polystyrene packing pellets, taken on September 13, 2019. (Photo by Neil Godwin/Future Publishing via Getty Images)

    Enlarge / A group of Black Friday online shopping purchases photographed in delivery boxes filled with polystyrene packing pellets, taken on September 13, 2019. (Photo by Neil Godwin/Future Publishing via Getty Images) (credit: Getty Images)

    If you build a gadget that connects to the Internet and sell it in the United Kingdom, you can no longer make the default password "password." In fact, you're not supposed to have default passwords at all.

    A new version of the 2022 Product Security and Telecommunications Infrastructure Act (PTSI) is now in effect, covering just about everything that a consumer can buy that connects to the web. Under the guidelines , even the tiniest Wi-Fi board must either have a randomized password or else generate a password upon initialization (through a smartphone app or other means). This password can't be incremental ("password1," "password54"), and it can't be "related in an obvious way to public information," such as MAC addresses or Wi-Fi network names. A device should be sufficiently strong against brute-force access attacks, including credential stuffing , and should have a "simple mechanism" for changing the password.

    There's more, and it's just as head-noddingly obvious. Software components, where reasonable, "should be securely updateable," should actually check for updates, and should update either automatically or in a way  "simple for the user to apply." Perhaps most importantly, device owners can report security issues and expect to hear back about how that report is being handled.

    Read 3 remaining paragraphs | Comments

    • chevron_right

      Home Assistant’s new foundation focused on “privacy, choice, and sustainability”

      news.movim.eu / ArsTechnica · Monday, 22 April - 17:34

    Open Home Foundation logo on a multicolor background

    Enlarge (credit: Open Home Foundation)

    Home Assistant, until recently, has been a wide-ranging and hard-to-define project.

    The open smart home platform is an open source OS you can run anywhere that aims to connect all your devices together. But it's also bespoke Raspberry Pi hardware, in Yellow and Green . It's entirely free, but it also receives funding through a private cloud services company, Nabu Casa . It contains tiny board project ESPHome and other inter-connected bits. It has wide-ranging voice assistant ambitions , but it doesn't want to be Alexa or Google Assistant. Home Assistant is a lot.

    After an announcement this weekend, however, Home Assistant's shape is a bit easier to draw out. All of the project's ambitions now fall under the Open Home Foundation , a non-profit organization that now contains Home Assistant and more than 240 related bits. Its mission statement is refreshing, and refreshingly honest about the state of modern open source projects.

    Read 8 remaining paragraphs | Comments

    • chevron_right

      Airbnb bans creepy surveillance cameras inside rentals starting April 30

      news.movim.eu / ArsTechnica · Monday, 11 March - 20:43

    camera hidden in flower pot indoors

    Enlarge (credit: Liudmila Chernetska/Getty )

    Airbnb, like hotels and rival vacation rental site Vrbo , will no longer allow hosts to record guests while they're inside the property. Airbnb previously allowed hosts to have disclosed cameras outside the property and in "common areas" inside, but Airbnb's enforcement of the policy and the rules' lack of specificity made camera use troubling for renters.

    Airbnb announced today that as of April 30, it's "banning the use of indoor security cameras in listings globally as part of efforts to simplify our policy on security cameras and other devices" and to prioritize privacy.

    Cameras that are turned off but inside the property will also be banned, as are indoor recording devices. Airbnb's updated policy defines cameras and recording devices as "any device that records or transmits video, images, or audio, such as a baby monitor, doorbell camera, or other camera."

    Read 11 remaining paragraphs | Comments

    • chevron_right

      “So violated”: Wyze cameras leak footage to strangers for 2nd time in 5 months

      news.movim.eu / ArsTechnica · Monday, 19 February - 21:03

    Wyze's Cam V3 Pro indoor/outdoor smart camera mounted outside

    Enlarge / Wyze's Cam V3 Pro indoor/outdoor smart camera. (credit: Wyze )

    Wyze cameras experienced a glitch on Friday that gave 13,000 customers access to images and, in some cases, video, from Wyze cameras that didn't belong to them. The company claims 99.75 percent of accounts weren't affected, but for some, that revelation doesn't eradicate feelings of "disgust" and concern.

    Wyze claims that an outage on Friday left customers unable to view camera footage for hours. Wyze has blamed the outage on a problem with an undisclosed Amazon Web Services (AWS) partner but hasn't provided details.

    Monday morning, Wyze sent emails to customers, including those Wyze says weren't affected, informing them that the outage led to 13,000 people being able to access data from strangers' cameras, as reported by The Verge .

    Read 11 remaining paragraphs | Comments

    • chevron_right

      Wyze outage leaves customers without camera coverage overnight

      news.movim.eu / ArsTechnica · Friday, 16 February - 19:03

    Wyze v3 camera pointed at viewer

    Enlarge (credit: Getty Images)

    Wyze cameras have been unreliable for many users for more than nine hours today, with cameras disappearing from the Wyze app or simply reporting errors when owners try to view them.

    Users started reporting issues on Down Detector just before 4 am Eastern time, and the company issued a service advisory at 9:30 am. As of 1 pm, the company stated that its "metrics show that devices are starting to recover," and later that there was "continued improvement," but it was still investigating history viewing issues. At 1:15 pm, an Ars writer was able to view his Wyze v3 camera feed and update its firmware.

    Wyze attributed the issue to an "AWS partner" in an earlier update. Amazon Web Services' dashboard showed no issues or outages as of 1:30 pm Eastern. Ars reached out to Wyze for comment and will update this post with new information.

    Read 2 remaining paragraphs | Comments