topic Re: Guest Brightness control is a potential security risk in Arlo

Guest Brightness control is a potential security risk

rcalver — Fri, 08 Jun 2018 16:57:56 GMT

I gave someone guest access to one of the cameras and recently noticed that it was much darker. From this to this. As you can see it's much harder to make out details. It took me a bit, but I figured out that the brightness level had been turned down to the minimum.

It doesn't appear that the guest did anything suspicious beyond that, but I'm still reluctant about whether I'll let them keep access. I think I trust him well enough, but would really rather not rely on trust.

Also, that said, guest accounts should be able to be given access to zero devices (currently the save button is greyed out when no device is checked) or the account suspended. As it stands the only solution is to delete his account completely and then go through the new account process whenever he wants to review videos.

Re: Guest Brightness control is a potential security risk

JamesC — Mon, 11 Jun 2018 17:27:32 GMT

recalver,

These rights can be adjusted by toggling access rights within the Grant Access settings. Take a look here for a list of things that shared users will or will not have access to based on access rights:

What privileges do my friends have when I grant them access rights in my Arlo account?

JamesC

Re: Guest Brightness control is a potential security risk

rcalver — Wed, 13 Jun 2018 18:09:55 GMT

That's just the thing - they don't have access rights. Yet they have control over the brightness.

Also, that same camera recently had night vision disabled. I'm the only person with access rights. So, either there's a problem with the perms of guest accounts or there's a security hole that my guest was able to use to get admin access to the system... either way, something isn't right here.

Re: Guest Brightness control is a potential security risk

JamesC — Thu, 14 Jun 2018 15:28:00 GMT

rcalver,

Friends without access rights have the ability to control the camera brightness. Take a look at the list in the article linked above for a list of what users can do with or without access rights.

JamesC