They are always very specific when saying that Flock cameras do not do face recognition. Because stated like this it's true. The face recognition doesn't happen on the camera (also not license plate reading etc.) instead photos are sent to central servers where they do the license plate reading and face recognition.
this post was submitted on 17 Sep 2026
202 points (99.5% liked)
Cybersecurity
10604 readers
143 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
founded 3 years ago
MODERATORS
Just a random string of characters:
HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD
Is that the token?
Ah yes, yes it is.
We are soon to find out if Flock blindly onboards random MAC addresses as new cameras.
If so, it seems anyone with the hardcoded key can authenticate with Flock ask if they were a new camera.
I wonder if that means you could “claim” a bunch of MAC addresses so you can block deployment of new or replacement flock cameras.
And it doesn't have to be a camera. It can just be a random set of images.
It can be
Gasp
Can it pretend to be information about me, but then instead it's all butt holes?
¿Porque no los dos?
Because mine is secretive 😶
OMG that user handle.
I'm going to go as a functional Flock camera for Halloween.
don't look surprised when someone in a hockey mask cuts your legs off at the knees with a chainsaw.
🎶 When you get knocked down, don't you get up again. We're all trying to keep you down.
damn that's good
So you're wearing Meta glasses?
Get it, freedom fighters! 🤘🏼✊🏼
If you think for about two seconds about the national security implications about this, this is extremely, extremely bad.
You're right, but Flock (and all of these cameras) is bad for the liberty of the people, so this is good. Any time a national security threat is found, it shakes the trust in these systems, so they're less likely to be trusted again.
The worst thing is that this isn't exactly new. The house heard about the vulnerabilities of this system in May.
https://www.youtube.com/watch?v=VKSjlZ6xyDo
Unfortunately, we're in such a state of plutocracy and regulatory capture that even stating how big of a national security risk they are did not make any movement until now.
In other words, it only makes movement when the general public finds out and starts sabotaging their cameras?
The damage really just amounts to insignificant outliers. There's so many cameras that the vandalized ones only make up a statistically insignificant portion.
At the moment, I believe the actual movement is coming from the ground up, grassroots movements that are going to their town halls and telling their representatives that they want these cameras the fuck out of their cities, and it seems to be working, at least somewhat.
I'd be lying though if I didn't feel some kind of justice and satisfaction every time I see that one dude in Florida carrying around a camera.
Keeps getting better
I wonder if this was a form of sabotage by an engineer, or regular incompetence
Hanlon's razor:
Never attribute to malice that which is adequately explained by stupidity.
But, also, Grey's law:
Any sufficiently advanced incompetence is indistinguishable from malice.
Why are you linking to bluesky instead of his article?
Lmao
Quick question: what would be the correct way to handle this, security wise? How should they acquire their token if it isn't present on-device?
I mean, each device could have its own token, but you could still sniff it, maybe? I dunno.
How should Flock have gone about this if working to their own self-interest?
Ethically? Expire the token since it's compromised, and offer to refurbish all units in the field since flock screwed up, a now all customer data could be poisoned/suspect now.
Realistically? Keep going like nothing happened an make it a customer support problem while pushing new hardened cameras that cost more. Because the product alone loudly flags Flock as a bunch of amoral greedy fuckwits.
I won't suggest ways to actually make their product bulletproof because I care and we don't need to make this problem worse for everyone. It is a tantilizing problem space but there are never any perfect answers in security, only relatively better/worse ones.
Oh, I don't mean afterwards. I meant before it even happened.
You give each camera its own token, and validate it with hardware ID.
Even better, give them hardware token, that can sign, but does not leak its keys.
In either way, you can ID the device, and block unsold and confirmed stolen/damaged ones. And never accept traffic from anything else.
One way would be to generate a unique private key on the secure element / TPM and its public key stored on the server for validation. Each API request would need to be signed with a relatively short expiration time. That way the code never contains sensitive content such as an API key, an exploited device only holds in RAM a signed certificate that is valid for a short period of time, and the certificate can be revoked/blocklisted on the server if compromised.
Unique private key per device, pre-provisioned certificate at manufacturing time, hardware-level separation of crypto operations so sensitive creds are never in memory.
It’s a bit more expensive to manufacture, in terms of BOM and logistics. And then you have a lot more complexity to your production system too.
Is it possible to have several private keys per singleton public key?
No.
y'all just givin the work away huh? don't answer this unless you are getting paid.
O... Kay, I'm just trying to expand my knowledge about this particular case. I'm mostly a web dev but I'm trying to expand into security a little bit as well because I think that's important for my field. It just wasn't a part of my curriculum at uni 10–20 years ago.
i was mostly joking 🙃 sorry if it came across as rude