Nodes in a social network

Stickers on cameras

While many privacy technologies and schemes are too complicated or cumbersome to reach mainstream penetration (PGP, OTR and similar things) there is an approch that you can see on hacker conferences just as much as you see it on the machines of people who wouldn’t be considered tech-savvy: Small patches stuck on webcam lenses.

The beauty of the idea is its simplicity: You do not want someone to watch you via your own camera that is very often pointed your way so you just make the video unusable. Brilliant. Easy to explain, easy and cheaply to apply and providing hardly any inconvenience. Why can’t all methods be this simple?

But when thinking about it further a few very interesting questions emerge:

  • Your camera can only be used to spy on you by someone having access to your machine (via some trojan or backdoor). While you can block the lense, the attacker can still log your passwords, steal you secret keys, meddle with your personal data, impersonate you online using your locally stored cookies and do all kinds of harm. The patch does signify a whole lot of distrust against the computer at hand, so why use that computer?
  • While the patch disables the camera, it does not disable the built-in microphone allowing attackers to keep listening to the room your computer is in. If that is the actual threat model you are trying to avoid, why are you not doing anything against the microphone?
  • When seeing a patched-over camera I tend to ask people if they also taped their smartphones because those have cameras as well and are as vulnerable as your computer. I have yet to meet people who explicitly did. Why is that? Even if it resides into your pocket a lot of the time it still could take pictures as soon as you take it out (in fact my friend scy build a tool for exactly that use case)

The patch does not really create a lot of extra security: If your  device is untrustworthy enough for you to tape the camera, you probably should get a new machine. So the patches largely seem to serve two purposes.

The first one is a communication purpose. By taping your camera you communicate to the people around you that you are not going to take pictures of them and that you “do what you can” to not have their picture taken by your devices. It’s a statement to build trust (which could obviously also be used to betray said trust but that tends to be the problem with trust either way) and show respect. In this way it can make sense, especially given certain contexts (being within a very security oriented crowd or amonst people who face very real threats by government or others).

The second purpose is the feel good purpose. Security is hard, the world is scary and I feel helpless in front of the computer. The patch creates – as little as it actually helps – a sense and feeling of control: I take one tiny aspect of possible danger and literally patch it with a small thingy to make me feel better. It’s like the Saint Christopher’s Medal that some people stick into their cars to protect them of accidents: Does not really do anything but give you a warm and fuzzy feeling.

This little “security hack” shows how little it’s actually about security but about control. About the feeling of agency and power. And a little about communication. But not about security in the meaning that IT security consultants work with.

(This German Facebook Post by Kai Denker sparked me writing this.)

3 thoughts on “Stickers on cameras

  1. I put it myself just this weekend — more for a practical reason though: Hangouts seem to start by default with webcam on, and if I’m using it it’s mostly to attend a meeting while I’m still home in my pajama ^^;;

    Also, I wouldn’t have done so if it wasn’t that I got the EFF ones, now those are cool to show off 😛

  2. Taping over the camera still serves as a security precaution, though. Yes, it does nothing against the other stuff trojans can do, but at least the person in front of the computer will not be photographed, say, naked. While the person may know they are not equipped to deal with trojans (or have, in the past, been “infected”) and they begrudgingly accept the possibility that some unknown entity can look at their data and use it to further their ends, the value of not having your picture taken naked often outweighs all other considerations. It is a whole lot harder to extort somebody using audio of sex acts than it is with pictures of sex acts, as well — and the RATing-“community” usually doesn’t put a lot of work into computers where the camera is off.
    It’s weird that people would value naked pictures as a higher security threat than being impersonated on the net, but apparently many do.
    Given stuff like it seems that taping over your camera mitigates said problem almost completely. It isn’t defense-in-depth, but it is defense.

    Personally I have neither microphone nor webcam active on the computer unless I plug in a USB device. That is more of a defense-in-depth approach — I am not particularly worried that my computer will get taken over, but if it does, this bit still helps. Pretty much like if my primary firewall gets busted, there is still the host-based one to contend with.

    Smartphones don’t tend to be angled towards your full naked figure all that often. You could take pictures of the user’s face, though more is a lot more uncommon. Smartphones are a great bug though, they rely on the microphone working for their operation, you don’t think twice about it having location data, and when you use it to make calls the back-camera can take nice pictures of the surrounding (unless you use a flap-cover which gets turned on the camera).

Comments are closed.