- All right, we gotta try this.
My voice is still a little jacked up, I've been sick,
but we need to talk about Ring doorbells,
because it's the holidays and a lot of you out there
are either gonna get a Ring doorbell this Christmas
or you're gonna give somebody
a Ring doorbell this Christmas.
And for good reason, right?
They're super popular
They've been really good for a long time.
But, there have been a lot of scary stories
in the news lately and rightfully so.
In fact, I'm not here to defend Ring at all.
I just want you to understand exactly what's going on
and how it is you can protect yourself
if you have a Ring
or if you're getting one for somebody for Christmas.
So, you ready?
Let's go do this.
(dramatic music)
So, this all kinda started with a story
about somebody's Ring camera getting hacked
and then the hackers,
who almost assuredly were wearing black hoodies
and fingerless gloves and looked something like this,
then started talking to the families through the camera,
through the speaker in the camera.
- [Man] Hello, is someone here?
Can you hear me?
- [Reporter] A man with a very distinct accent
took over the Reed family's Ring security system.
- It game me chills.
And anybody that I played it for
said that they felt chills up their spine.
- That's bad, okay.
It's real bad and it's scary as hell
because if somebody can talk to you
through the speaker in the camera,
it means they can also see
what's going on through the camera.
That's really really bad.
But here's the thing, the camera wasn't hacked, okay.
It's not like somebody snuck in through the backyard
and clipped some wires like they do in the movies
and then could suddenly see everything going on
with the camera.
No, the camera was just fine
and it was working the way it's supposed to.
In fact, I'd argue that what actually happened
is actually worse.
But, before we get into that,
I want to talk about this other story that just came out.
Buzzfeed got a scoop that about 3,000 Ring usernames
and addresses and emails and all that stuff got leaked.
And that gets us to the root of the problem I think
and it's this.
Human beings are really bad at creating passwords
and the companies that we're trusting with our passwords
are doing a really bad job
of making sure that we use better passwords
and that we have all the safety protections
in place on our accounts.
So, this is actually the same sort of problem that we saw
when Disney+ launched back in November
and you saw some scary stories
about people getting locked out of their accounts.
Here's what actually happened.
People are reusing passwords.
I get it, I've done it too, right.
You use a password, you know it, you can remember it,
so you just use it at a smattering of places
and don't think anything of it,
because well, it's not all that important, right.
It's a magazine subscription or something, whatever.
But the problem is when those emails and passwords
get leaked and some bad guys somewhere get them,
they say hey, I'm gonna go try that email,
I'm gonna go try that password somewhere else.
And of course that somewhere else happens to be Ring,
because Ring is super popular.
There are a whole bunch of them out there
and it's a right target because what does it do?
It looks at ya, I've got a camera up there right now.
It's spying on you all the time.
It's not really spying, it's doing its job, right.
It's watching you.
But that's what makes it such a ripe target.
So, passwords being reused and leaked and used again,
that's just part of the problem.
That's on us, the user.
Another part of the problem here,
is that Ring could have and should have done a lot more.
It could've had the technology in place
to say hey Phil, I see you usually log in from Pensacola,
but I just got a login request
from say, I don't know, Russia.
So, I'm gonna go ahead and block that
until you tell me it's okay,
but just heads up that happened.
That's a standard thing that all kinds of services do.
Ring didn't.
And Ring could've made it mandatory
that you have to use some sort of two-factor authentication
when you log into your account.
You get a secondary code via text message
which works but isn't great.
Or you have to use one of those software token apps
like Google Authenticator.
That's better.
Even better than that though
would be using something like a hardware key.
In fact, I happen to have one in my pocket right now
'cause I'm a huge nerd.
I've done a whole video on those, go watch it.
It's super cool.
And actually Ring does let you use text messages
for two-factor authentication
but it's optional and it's buried deep down on the settings.
And guess what?
My mom's not using it.
And another thing Ring could've done
would be to implement a service like Have I Been Pwned?
That's a really cool service
where all these leaked emails and passwords
get dumped into a database and hashed and hidden
and all that stuff, so your data isn't leaked a second time.
And then when you create a new password on Ring,
it could say hey Phil,
I see you're trying to use that password 1-2-3-4,
not only is that a really bad password
but you've used that some other place
and it's been leaked already.
Maybe don't do it again this time.
Ring could've done that but it didn't.
So, just a recap, what's going on.
We the users have been using bad passwords
and we've been using them over and over again
on multiple services.
So, if they get leaked one place,
bad guys are gonna go try them somewhere else.
And Ring, for it's part,
hasn't done enough to help us use better passwords
and to help us with better login authentication
to make sure it's really us
trying to get into our cameras and stuff.
So, what should you do
if you get a Ring camera this Christmas
or if you're getting one for somebody else?
Should you just throw it away and not install it?
I don't know, I'm gonna leave that one up to you
to decide for yourself I think.
But if you're gonna keep it,
at the very least you need to do a few things, okay?
First, make sure you're using a strong, unique password.
And use a password manager, okay?
I've got a whole video on those.
Go watch it, it's super important.
It's gonna make your life a lot easier
and a lot more secure.
And don't give your Ring login to anybody else, okay?
If you got family members you wanna give access to,
you can set them up as a secondary user on the account.
Second, and I can't stress this enough.
Use two-factor authentication whenever possible.
Don't skip it, okay?
Text messages are okay if that's all you have.
Software tokens in an app
like Goggle Authenticator are better.
And even better than that,
is a physical hardware key.
And third, I'm just gonna throw it out there,
I'm a big fan of Have I been Pwned?
Okay, go give it your email address.
And it's gonna keep track,
so if your email gets caught up
in another data breech somewhere,
you're gonna know about it as soon as it happens.
So, I hope that helps a little.
No, Ring cameras haven't been hacked.
The problem is the accounts aren't as secure
as they could be.
Some of that's our fault as the users,
a lot of that's Ring fault
as the company that's supposed to be keeping our stuff safe.
And I'm gonna say this again 'cause I can't say it enough.
You need to be using strong, unique passwords
every single time.
Do not reuse them.
So, that's it for now.
Be sure to follow me on the socials
and subscribe to the channel if you haven't already.
Hope everybody has a Merry Christmas and Happy Holidays.
See ya next time.
(soft upbeat music)