Micah Lee (@micahflee.com)
bsky.app
HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD What is that? That's a hard-coded API token that Flock cameras use to identify themselves and get OAuth credentials, which can then be used to talk to Flock's production servers. Like, anyone on the internet can probably do this right now.
HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD
    • msage@programming.devEnglish
      3·
      5 days ago

      You give each camera its own token, and validate it with hardware ID.

      Even better, give them hardware token, that can sign, but does not leak its keys.

      In either way, you can ID the device, and block unsold and confirmed stolen/damaged ones. And never accept traffic from anything else.