# "My Name is Talky Tina, and I know your Bank Password!" **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [February 28, 2017, 12:56pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024 "2017-02-28T12:56:46Z")\ **Posts on this page:** 17\ **Page:** 2
**Author:** ![Alley\_Dweller](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alley_dweller/32/430_2.png) [@Alley\_Dweller](https://boards.straightdope.com/u/Alley_Dweller)\ **Post date:** [March 1, 2017, 1:28am UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/21 "2017-03-01T01:28:08Z")
> [@Jackmannii](#): > > Why were login and password info even stored on the company’s server? I would want to avoid any devices with that setup. > > [Here’s](http://www.computerworld.com/article/2878741/hacker-hijacks-wireless-foscam-baby-monitor-talks-and-freaks-out-nanny.html) a link to the nannycam scandal story. I assume they were stored there to make sure that only authorized persons were allowed to access a given teddy bear and so people could connect to a given teddy bear without having to pay for a static IP address. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [March 1, 2017, 1:57am UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/22 "2017-03-01T01:57:45Z")
Pardon my digression, but I do not recall why Talking Tina did not like Telly Savalas, and how she whacked him. Was it she he tripped over on the stairs? ---
**Author:** ![Newtosite](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/newtosite/32/8623_2.png) [@Newtosite](https://boards.straightdope.com/u/Newtosite)\ **Post date:** [March 2, 2017, 3:03am UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/23 "2017-03-02T03:03:03Z")
Yes, he tripped over the doll and fell down the stairs. If I recall correctly, she was reacting to his dislike of her. And it’s been theorized that he didn’t like her because he didn’t like the child who loved her (his stepdaughter). I have no idea if that was the case. ---
**Author:** ![Colibri](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/colibri/32/1841_2.png) [@Colibri](https://boards.straightdope.com/u/Colibri)\ **Post date:** [March 2, 2017, 4:40am UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/24 "2017-03-02T04:40:23Z")
> [@carnivorousplant](#): > > Pardon my digression, but I do not recall why Talking Tina did not like Telly Savalas, and how she whacked him. Was it she he tripped over on the stairs? Telly Savalas was hostile and mean to his stepdaughter Christie because he resented her because couldn’t have children of his own. When her mother bought her the doll, he complained that it was too expensive. Christie is delighted with the doll, and it says “I love you” to her. When Savalas tries it when he’s alone with the doll, it says “I don’t like you very much.” Things escalate from there. At first he is convinced that his wife is playing a joke on him through a hidden mike. Then he tries to throw the doll out or destroy it, unsuccessfully. It finally tells him it’s going to kill him. He dies when he trips on it on the stairs. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [March 2, 2017, 1:36pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/25 "2017-03-02T13:36:37Z")
Thanks! ---
**Author:** ![Melbourne](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Melbourne](https://boards.straightdope.com/u/Melbourne)\ **Post date:** [March 2, 2017, 8:34pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/26 "2017-03-02T20:34:13Z")
> [@carnivorousplant](#): > > It didn’t do much good for Telly Savalas, either. > > Did this fellow get into a database, or the actual devices? Getting onto a home network seems worse to me that reading a child’s messages. What a way to deliver a ransom note! “I’m Talky Tina, and if you ever want to see Sally again…” According to the tech sites, the whole database has been wide open forever, has been compromised a number of times by criminals, and yes, you could deliver ransom notes like that by inserting them into the database. ---
**Author:** ![Amateur\_Barbarian](https://avatars.discourse-cdn.com/v4/letter/a/59ef9b/32.png) [@Amateur\_Barbarian](https://boards.straightdope.com/u/Amateur_Barbarian)\ **Post date:** [March 2, 2017, 8:38pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/27 "2017-03-02T20:38:20Z")
I think Harry Harrison’s “I Always Do What Teddy Says” is must reading for this thread, especially in this era. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [March 2, 2017, 9:06pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/28 "2017-03-02T21:06:01Z")
> [@Melbourne](#): > > According to the tech sites, the whole database has been wide open forever, has been compromised a number of times by criminals, and yes, you could deliver ransom notes like that by inserting them into the database. But it is the database, not the devices themselves, I believe. I wonder how many of the “Internet of Things” allow access to the user’s home network. ---
**Author:** ![kferr](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kferr](https://boards.straightdope.com/u/kferr)\ **Post date:** [March 3, 2017, 2:23pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/29 "2017-03-03T14:23:11Z")
Here’s article from [The Register](https://www.theregister.co.uk/2017/03/01/cloudpets_woes_worsen_mics_can_be_pwned/) explaining and demonstrating how an attacker can take over the toy. The first link in the artile goes to the story about their database breaches. There is also this [BBC video](http://www.bbc.com/news/technology-38966285) showing how a Cayla doll can be used to unlock a voice activated door lock. ---
**Author:** ![kferr](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kferr](https://boards.straightdope.com/u/kferr)\ **Post date:** [March 3, 2017, 2:32pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/30 "2017-03-03T14:32:26Z")
> [@carnivorousplant](#): > > But it is the database, not the devices themselves, I believe. > I wonder how many of the “Internet of Things” allow access to the user’s home network. From the Register article about the database breach: > [@The Register](#): > > As Hunt dug deeper, things got more bizarre: yes, the account passwords in the database were hashed with bcrypt, but the website had no password rules, and its tutorial used only a three-character password – meaning many of the passwords were just a few characters and crackable anyway. The account records included email addresses, hashed login passwords, user IDs, and login times and dates. So with just the database the attacker cracks the weak passwords, logs into the Cloudpets app on their own device, and communicates with the toy. ---
**Author:** ![Amateur\_Barbarian](https://avatars.discourse-cdn.com/v4/letter/a/59ef9b/32.png) [@Amateur\_Barbarian](https://boards.straightdope.com/u/Amateur_Barbarian)\ **Post date:** [March 3, 2017, 3:10pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/31 "2017-03-03T15:10:23Z")
> [@carnivorousplant](#): > > But it is the database, not the devices themselves, I believe. > I wonder how many of the “Internet of Things” allow access to the user’s home network. Far too many. This is yet another area of tech driven by naivety and marketing where even the idea that the components might be misused has failed to occur to anyone. It’s not just deliberate and malicious intent by marketing types we need fear, but this kind of blindness, in that opening deep doors in our physical and behavioral defenses something other than marketing slogans and “benefits” might wander in. It’s bad enough when it’s just malware in a computer. It’s far worse when individual security and safety are at risk… not to mention truly black uses of manipulation. Worked with too many programmers who were blind to such unlocked doors… “it’s just a game” or “no one’s going to hack a thermostat, fer God’s sake.” ---
**Author:** ![Urbanredneck](https://avatars.discourse-cdn.com/v4/letter/u/ea5d25/32.png) [@Urbanredneck](https://boards.straightdope.com/u/Urbanredneck)\ **Post date:** [March 3, 2017, 8:57pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/32 "2017-03-03T20:57:52Z")
I just wanted to add that years ago before the web the thing was baby monitors. Those household small radio intercoms that back then it wasnt uncommon for people to be able to listen in on other peoples communications by having the same unit. But these are even scarier. ---
**Author:** ![septimus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/septimus/32/410_2.png) [@septimus](https://boards.straightdope.com/u/septimus)\ **Post date:** [March 4, 2017, 9:48am UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/33 "2017-03-04T09:48:54Z")
> [@Idle\_Thoughts](#): > > Be that as it may, the note stands, because it came off as I said it did. FWIW, the intent of **Amateur Barbarian** ’s post was absolutely clear to me (though perhaps opposite to what you thought). IMHO, he made his point in a concise, though acerbic, way. If he had enclosed a smiley-face icon, e.g. :rolleyes: , his facetious intent would have been even more clear. Would his post have been acceptable then? ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [March 4, 2017, 7:52pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/34 "2017-03-04T19:52:38Z")
> [@CalMeacham](#): > > Who knew? Sarcasm? It’s a cheaply made Internet of Things toy. Of course it’s hackable. That’s how every DDOS now works. These things are not secure. I got my parents (among other things) a key finder for Christmas. I specifically avoided the ones that work via connecting online, specifically because IoT things are just bad. Oh, and this is Black Mirror shit, if anything. It’s beyond the stuff the Twilight Zone people thought of, IMO. And, if this is not old news, it’s not the first time this has come up. I hear about these devices that phone home with info being hackable all the time. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [March 4, 2017, 8:34pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/35 "2017-03-04T20:34:09Z")
> [@carnivorousplant](#): > > But it is the database, not the devices themselves, I believe. > I wonder how many of the “Internet of Things” allow access to the user’s home network. It’s entirely plausible that the toys “phone home” every so often to exchange messages with the server. If so, the server connection would be “pull” from inside your home network, not “push” from the server through your firewall into your home network. It’s still the case that if the device can reach out to the server then bad guys can, at least in principle, place malicious content on the server to be collected and acted on when the device next connects. And if the device is secured poorly enough, it just became a bot. ---
**Author:** ![Idle\_Thoughts](https://avatars.discourse-cdn.com/v4/letter/i/838e76/32.png) [@Idle\_Thoughts](https://boards.straightdope.com/u/Idle_Thoughts)\ **Post date:** [March 5, 2017, 2:53pm UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/36 "2017-03-05T14:53:30Z")
> [@septimus](#): > > FWIW, the intent of **Amateur Barbarian** ’s post was absolutely clear to me (though perhaps opposite to what you thought). IMHO, he made his point in a concise, though acerbic, way. > > If he had enclosed a smiley-face icon, e.g. :rolleyes: , his facetious intent would have been even more clear. Would his post have been acceptable then? As I said earlier in this thread, take all discussion about it to ATMB. ---
**Author:** ![CalMeacham](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/calmeacham/32/35_2.png) [@CalMeacham](https://boards.straightdope.com/u/CalMeacham)\ **Post date:** [March 6, 2017, 1:54am UTC](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024/37 "2017-03-06T01:54:00Z")
> [@BigT](#): > > Sarcasm? It’s a cheaply made Internet of Things toy. Of course it’s hackable. That’s how every DDOS now works. These things are not secure. > > I got my parents (among other things) a key finder for Christmas. I specifically avoided the ones that work via connecting online, specifically because IoT things are just bad. > > Oh, and this is Black Mirror shit, if anything. It’s beyond the stuff the Twilight Zone people thought of, IMO. > > And, if this is not old news, it’s not the first time this has come up. I hear about these devices that phone home with info being hackable all the time. Sarcasm. [Previous page](https://boards.straightdope.com/t/my-name-is-talky-tina-and-i-know-your-bank-password/781024.md?page=1)