Hi everyone. So what could bring me back out of semi-retirement to make a new video
for you? Well this is something so rage-inducing that it has to be spoken about really. So
you may be aware of a company called VTech. They make learning tools for children, parents buy them in
their thousands and they're normally kind of like a cut-down laptop or iPad
style things with plastic shells and basic software. And it's all designed as a
learning aid for children. Learn your ABCs, learn your times tables and so on.
Now last year there was a major security issue over at VTech. Someone, a security
researcher, discovered, that VTech basically had decided not to take
children's security even remotely seriously. They weren't salting their
MD5 passwords and hashing, there was no SSL encryption anywhere
sql statements were returned in API calls... basically you put together a
list of every security violation you could possibly think of and VTech probably
did it. Essentially they were grossly incompetent in looking after the data
that parents were asking them to look after on the child's behalf essentially. Now
why this has now raised its ugly head again is because VTech have decided that
rather than actually dealing with the problems because their platform is donkeys
old and they probably can't fix a lot of these problems without scrapping the whole thing
and starting again, they've decided to simply change their terms and conditions. Now
listen to this: The new terms and conditions
state that you acknowledge and agree that any information you send or
receive during your use of the site, that's VTech's site, may not be secure and may be
intercepted or later acquired by unauthorized parties. Wow! So what VTech
are saying here is if you use our services you do so at your own risk.
We are not going to give you any guarantee that we can look after your
child's data.
So if that child has for instance uploaded photographs as some VTech
products seem to do, if the parent has allowed for credit card information and
address details and even phone numbers to be held by VTech, VTech can't guarantee its
safety. Simple as that. So here is a company who has built its entire, well, company, it's bet it's
farm as it were, on children's products yet these connected children's products
are not secure and VTech say they can't guarantee it. Now I think it's pretty
obvious any parent is going to look at this and simply say, well, why should I buy a
VTech product? If they can't guarantee the safety of the data that they are hoovering up
on my child's behalf and my behalf
why should I buy their product and actually that is exactly the thing you need to be
saying here. These connected devices these internet of thing devices as we are
now calling them, unfortunately they are a huge security threat and it doesn't matter
whether we're dealing with kids' toys, like Barbie dolls with webcams in them -
who the hell thought that would be a good idea? Or if we're dealing with, you know, a
connected light switch in your home or connected boiler, or even something as simple as a
wall socket that also happens to be connected to the internet, it's becoming
more and more important that we secure our own lives and only have devices
within our environment that we can guarantee are secure or at very least the
company is prepared to say we are going above and beyond in securing these
products. VTech are basically saying don't buy our product, please don't buy our product, please don't buy
VTech's products, we can't secure your children's data, we can't secure your data.
If it's a connected VTech product please don't buy it and I would echo
that sentiment. VTech are being very good here really. They're screaming from the top
of their lungs we are not going to be able to keep this data secure, please
don't buy our product. Actually they're not they're burying it in the terms and conditions
but you get my point. By saying that they can't secure our data they've invalidated
themselves as an Internet of Things company -
doubly so because they are dealing with children's data. Do not buy VTech's products. I
really do hope that they take a good kicking over this next year, see their
product simply disappear from store shelves as retailers realize you can't
stock a product for children which has zero security built-in really to prevent
its data from being stolen.
VTech have shown through their complete lax approach to security of their own
platforms they aren't to be trusted and they certainly shouldn't be getting your
money.