Latest in Gear

Image credit: Ring

Ring doorbell flaw lets others watch after password changes (updated)

At one point, the camera was exposed for months.
686 Shares
Share
Tweet
Share

Sponsored Links

Ring

You'd expect a smart doorbell to instantly boot out everyone the moment you change your password, but that isn't necessarily the case. The Information has learned that the app for Ring's video doorbell wasn't forcing users to sign-in after password changes, regardless of how much time had elapsed -- in one case, an ex-partner had been watching the camera for months. Ring said it started kicking people out in January, after receiving word of the incident, but that window of opportunity still lasted several hours in an Information test.

The issue, as you might guess, is that the window exists in the first place. Someone with a still-valid login could not only spy on whatever's happening, but download videos. The same incident that prompted the change also included phantom rings in the middle of the night.

The flaw provides something of a headache for Amazon, which only acquired Ring in February. If it's going to use Ring's doorbells as part of delivery solutions like Amazon Key, it needs to know that the devices are reasonably secure against exploits like this. This is also a reminder that smart home security needs to be particularly tight -- a loose policy can easily lead to privacy violations.

Update: Ring has issued a statement promising both additional improvements and reminding users to avoid sharing login details when possible. You can read it in full below.

"Ring values the trust our neighbors place in us and we are committed to the highest level of customer information and data security.

"We strongly recommend that customers never share their username or password. Instead, they should add family members and other users to their devices through Ring's "Shared Users" feature. This way, owners maintain control over who has access to their devices and can immediately remove users.

"Our team is taking additional steps to further improve the password change experience."

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
686 Shares
Share
Tweet
Share

Popular on Engadget

Samsung patent application showcases AR headset design

Samsung patent application showcases AR headset design

View
Verizon is giving Unlimited customers 12 months of Disney+ for free

Verizon is giving Unlimited customers 12 months of Disney+ for free

View
Best Buy takes on Amazon with free next-day deliveries

Best Buy takes on Amazon with free next-day deliveries

View
PlayStation's Halloween sale includes 'Dark Souls 3' and 'Devil May Cry 5'

PlayStation's Halloween sale includes 'Dark Souls 3' and 'Devil May Cry 5'

View
OmniVision wins Guinness World Record for its tiny medical image sensor

OmniVision wins Guinness World Record for its tiny medical image sensor

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr