topic Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)? in Arlo

Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Sun, 07 May 2017 00:08:10 GMT

Hi guys,

As topic; where can I deauthorize third-party services that I've connected to my account, such as IFTTT? i've looked all over for it without any luck.

When connecting, it takes me to an URL in the format of: oauth.netgear.com, but I've found no other link in the Arlo interface to see what services are currently connected and how to revoke their access.

Hopefully there's a way and this wasn't overlooked, because if not, it would be quite a security issue.

Thanks.

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

TomMac — Sun, 07 May 2017 00:54:37 GMT

in the meanwhile... you could change your account info

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Sun, 07 May 2017 01:02:50 GMT

Hi Tom, what do you mean by account info? The Arlo password? If so, OAuth authentications are tokens that don't take into consideration your username/password combination, so that wouldn't block the services from still being allowed to connect.

If there's now way, it would be a terribly security oversight, as we need to see a list of all the services connected to our accounts and be able to revoke them access at will.

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

TomMac — Sun, 07 May 2017 10:45:38 GMT

Yes, but doesn't the client sw have your info when registered ?... as the token does not

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Sun, 07 May 2017 13:21:18 GMT

I'm not sure I'm understanding you... do you mean the client software? IFTTT (for example)?

It connects to Arlo based on the OAuth token that IFTTT saves when I confirm the access and Arlo/Netgear has a list of approved services that can access them on their servers. What we need, is a screen to be able to see those approved services and revoke them access.

Changing the user/password/etc in any of the services (Arlo, Netgear, IFTTT, etc.) wouldn't do anything and the connection would still be allowed.

Here's a nice example of a security theat. I somehow hack into your IFTTT account and get access to it. I can then create rules to know when you are in the house (motion detection), how many cameras do you have and where they are located (based on their name), I can profile you and get to learn your schedule after studying it for a couple of weeks (i.e. knowing when motion is detected every day and at what times [leaving for work in the morning? house is empty?] and predict a pattern of your behaviors and when you might be out of your house) and also know when your batteries are running low (so I then I can get in and steal the heck out of it!) The best part: you don't have any way to stop me from keep doing that (except deleting your Arlo account, but for that, you'd have to know that I've gain access to your IFTTT account)

If that scared you, then that's why we need to have a screen to revoke access to connected apps, as it's pretty much mandatory in any OAuth implementation (Google, Microsoft, Dropbox, Facebook; whichever service that use them, has them).

If we don't have that, maybe it's a nice time to escalate this. Maybe @JamesC can chime in here?

Thanks again

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

fuzzypixel — Mon, 08 May 2017 00:59:22 GMT

Assuming Netgear's auth is done correctly once you change your arlo account password the token used by IFTTT (or any other party which has your token) will no longer be valid, it will require re-authentication (with username/password) so that it can get a fresh one.

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Mon, 08 May 2017 21:19:25 GMT

It's not part of the OAuth specs to determine if they should revoke the tokens on a password change. It depends of the implementation, as the tokens should be able to be individually revoked at will (imagine having to reauthenticate dozens of services on every password change).

Google for example, just during the end of last year started implementing the revoke of the tokens on a password reset (http://www.securityweek.com/google-revoke-oauth-20-tokens-upon-password-reset), as an additional securiy measure to their already "Connected Apps" interface, where you can see who is accessing your account and revoking them.

As of now, we don't know what Netgear is doing, how they implemented it and what are they doing to protect us.

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

fuzzypixel — Tue, 09 May 2017 00:31:20 GMT

But it's easy to test, isn't it? Authorize a service like if ttt and then change password on netgear website. If ifttt still works after a reasonable timeout then netgear isnt doing it right, if it asks you for new password then it works agents expected.

And of couse more granular token revocation would be better, but at least you would know you could use the hammer if needed.

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Tue, 09 May 2017 05:16:11 GMT

I'd love to test it, but as I posted when I bought and set up the kit, IFTTT never works for me. It doesn't get triggered and always writes an error to its log instead.

IFTTT Arlo isn't Working - Returns "Error" All the... - NETGEAR Communities

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

islandboylp — Thu, 11 May 2017 07:44:04 GMT

I had the same question of how to revoke ifttt access if I choose, but also couldn't find anywhere to do this.

So I tested the theory of changing my arlo password in hopes that ifttt will require a re-auth, but this failed. Even with an arlo password change my ifttt triggered my arlo camera with no delay.

It's be good if netgear or part of the arlo team could comment on this.

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Thu, 11 May 2017 17:56:39 GMT

Thanks for your comment islandboy. Hopefully, @JamesC from Netgear can comment on this.

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Fri, 12 May 2017 19:03:18 GMT

Thanks for your workaround islandboy. I knew about that; I actually did that several times in order to troubleshoot why IFTTT doesn't work, but as you also said, that's not optimum and we need to revoke at the source. Imagine the case of having your IFTTT account stolen and someone snooping around with your cameras...

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

islandboylp — Fri, 12 May 2017 19:07:08 GMT

I agree Timmy! Hopefully Netgear support will have a better answer for me soon.

On a side note...My previous post disappeared..?

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

islandboylp — Fri, 12 May 2017 19:22:52 GMT

Adding back my previous post for reference in case it helps anyone else...since it disappeared for some reason.

IFTTT allows disconnecting services from the Services settings.

From IFTTT FAQ:

How do I change the account associated with a service?

Go to the service page you’d like to change.

Select Settings.

Select Edit connection.

Enter the login credentials for the account you want to use.

I accomplished this by logging into my IFTTT account, click on Services-->Arlo-->Settings which will bring you to this page, which has "Disconnect Arlo" at the bottom:

This isn't the best solution as revoking access from the source (Netgear) would ensure that the token is revoked, but this is better than noting at this point.

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Sat, 13 May 2017 06:09:00 GMT

Yeah, your previous post dissapeared! Guess they couldn't handle the reality!

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Sat, 27 May 2017 00:49:29 GMT

@JamesC, can you comment something on this security issue?

Thanks.

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Sun, 28 May 2017 07:41:02 GMT

Well, how great that when you search "OAUTH Netgear" in Google, this thread is the first result that shows up, exposing the security issue that we have unaddressed here...

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

JamesC — Tue, 30 May 2017 20:40:08 GMT

Timmy256,

I have escalated this topic. I will post an update when I have more information.

JamesC

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Thu, 01 Jun 2017 07:52:05 GMT

Thanks for your reply @JamesC, hopefully you guys can fix this security issue with an UI to revoke access to third party apps.

Re: Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

Timmy256 — Wed, 12 Jul 2017 22:04:43 GMT

Hi @JamesC, do you have any update on this issue so far?

Thanks.