Nest issues cryptic warning — spoiler alert, it’s about strangers peeking your cameras

Today, Google is doing something it should have done weeks or months ago: it’s emailing owners of its Nest security cameras that they should really, really pick a better password, enable two-factor authentication (2FA), and be vigilant if they don’t want strangers to hijack those cameras and peek into their homes over the internet, which has actually been happening in some instances, including a fake nuclear bomb threat that really freaked one family out.

The thing is, Google’s email doesn’t actually say why people should be vigilant right now. It doesn’t mention the camera scares at all.

“We’ve heard from people experiencing issues with their Nest devices,” reads a painfully generic line in the email.

“People with access to your credentials can cause the kind of issues we’ve seen recently,” reads another.

Nowhere does the email describe the “kind of issues” that “we’ve seen.” In fact, the word “camera” doesn’t appear in the email even once.

To be fair, it’s a lose-lose situation for Google, which isn’t exactly responsible for this problem and doesn’t want to scare people off.

If the company clearly states precisely why now is a good time for you to enable 2FA, it might scare people away from buying its security cameras. People might not realize that, no matter how hardened a camera’s security might be, it only takes one data breach anywhere in the world to expose a username and password that you might have used on your Nest camera as well. At that point, hackers don’t need to hack: they just log in with your own account.

It’s not Google’s fault if you’re using the same password for everything. Seriously, stop that. Use a password manager. Turn on 2FA now.

But it is Google’s responsibility to warn its customers of the danger here, and it’s only kind of-sort of doing that today. So why don’t we help out Google a bit with this post?

Being transparent with its customers might help, but Google could also take some more concrete steps to protect against this problem, like requiring users to create strong passwords and set up 2FA to begin with or make a conscious decision to opt out if they want to be less secure. Google could also have Nest adopt the same 2FA system it uses for its web apps, which is oddly missing here.

Google did roll out an unrelated tool this week to protect against password breaches, though: this Password Checkup extension for Google Chrome.

Full Article: https://www.theverge.com/2019/2/6/18213956/nest-cryptic-warning-security-cameras-strangers-peeking