WHY do manuafacturers allow this in their devices? It would
seem to me to be a simple matter to "detect" the reset un and
pw (as hashes?), and if those two match then do not broadcast.
I've wondered this myself, but in particular, I've wondered this about SOHO WiFi Routers, the sort almost everyone has, which have file-sharing capabilities and an FTP server built in. People plug in flash drives or portable hard drives with the intent of sharing to others in their home.
The net is full of people who think they're sharing locally but are sharing
out to the whole world. People have scans of passports, bills, bank statements, tax data, birth certificates, photographs, and all manner of personal material they think they're sharing to their household, but which is shared out to the Internet.
Some years ago I got curious about these old FTP sites at universities and
the like with old data stretching back to the 1980s (University of Toronto's
is quite a masterpiece). That one had the original analysis of Morris Worm with the original timestamp on it.
In searching for more of these I found countless FTP sites running out of people's homes - people obviously unaware they were sharing this stuff with
the Net generally. Most of these are set up with anonymous logins, or simply never send a login or password prompt; you're just dumped right at the main directory.
Likewise with security cameras. I keep getting the sense that security and privacy are just *no concern at all* for these companies, and while I can forgive a mistake or bug, it increasingly seems like they spend no effort at all on making these systems secure out-of-the-box, or, at least, displaying warnings when people turn on features which share out to the Internet at
large.
--- Mystic BBS v1.12 A46 2020/08/26 (Linux/64)
* Origin: Shipwrecks & Shibboleths [San Francisco, CA - USA] (21:1/227)