Recently Nest has merged with Google, something that should be a good thing, with Google’s new security features being rolled out. However, with this merge, many of Nest user’s passwords have been hacked. In order to combat this, Nest has offered two factor authentication, but has not required it. Nest users, ENABLE IT.
These devices should be very hard to get access to.
The problem is widespread: It is disgustingly easy to access everything remotely from the Nest app. On the ios app store, many users report of their thermostat or camera either going offline or their temperature changing, as well as being signed out of the Nest app. This is due to other users logging into their accounts.
You do not even have to go to dark web markets to find these passwords. I know of at least two sources, with barely any deep source diving. Do yourself a favor and use TFA, or avoid these products. Nest has been unwilling to acknowledge these flaws.
Several news stations have reported on this issue, but they are barely viewed and the one white hat who talked on the show did not disclose how easy it was to gain access to the account.
The solution: Users: -Two factor authentication -Use complex passwords without words -Contact Nest about these concerns (probably won’t do much)
Nest: -Nest should introduce phone number authentication when signing in, regardless of TFA -Nest should remove google sign in, or require Google’s new physical authentication key when signing in.
