Skip to main content
Contributor I
May 24, 2018

Must have PASSWORD PROTECTION to our business Sonos setup

  • May 24, 2018
  • 20 replies
  • 7640 views
Yes we have guest WiFi, but employees are on internal WiFi to access fileservers and resources. And no one has Admin access to install the Sonos app BUT Spotify has now added a Sonos feature and Spotify can be downloaded WITHOUT admin approval or install password - so the onus is now on Sonos to be able to protect playlists on the company Sonos systems. I would NEVER recommend a Sonos system to a corporate business for this one reason. Clients are here and then someone throws on heavy trap rap and N this and N that or whatever. And now it looks like the IT dept has no control over their employees and or systems and there's no way to know who made the change for a reprimand - ridiculous. HIGHLY RECOMMEND A PASSWORD ONLY SYSTEM. It's been 4 years now we have been asking for this and nothing. Sonos = No STARS. #FAIL
This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.

20 replies

Contributor I
June 14, 2018
Controlnav, sorry for the rant, took out my frustration with Sonos on you and I do appreciate your help. And the reason for malware so prevalent today is becuase nothing is secured. Every device should have a PIN at least, or two-step verify. We live in a time that all my websites, networks, routers, switches are constantly being monitored for the thousands of threats a day I get from all over the world. And there are security issues with Sonos: http://www.eweek.com/security/security-flaws-found-in-sonos-internet-connected-speakers
melvimbe
June 14, 2018
I took a look at the article you posted. Sonos fixed the issue already without adding authentication. The article does recommend adding authentication to Sonos, but it is referring to administration and monitoring functions, not access to the system as a whole system. Besides, your initial complaint had nothing to do with security from hacking, but from keeping your own employees from using the system against managements request that they do not.

BTW, I would think you're problem may become a little worse once airplay 2 is implemented. As I understand it, anyone with an apple phone will be able to stream audio from any source on their phone to Sonos speakers. That may be easier to monitor and/or control though as it is a stream from a local source on the network vs something coming from outside the network.
Danny
Contributor I
June 14, 2018
Yes, Airplay 2 will make everything null and void and Spotify already has Sonos play built into it, so everyone has access to the speakers at any time with their phones. This is why a simple PIN code, JUST LIKE AIRPLAY from Apple. We use them in our Conf rooms, and if we couldn't add a PIN code to use it, it would be quite embarrassing during a client meeting. Same should apply to Sonos. Even though they 'patched' it means nothing in the future for zero day exploits or any other exploits.

While my original question was basically answered 'it ain't gonna happen' - I started to think of all the other security issues with connected devices, especially since I'm in charge of keeping a company running including IOT security. Or if I could at least find out who's connecting. Anyway, I need full control over the things I purchase and install in my Enterprise environment, that's it.
Contributor I
June 20, 2018
Yes SONOS (and everyone posting here), you are vulnerable to DNS rebinding attacks. https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability/
Airgetlam
June 21, 2018
To quote from the article: "Google, Roku, and Sonos have all patched or are in the process of patching their device operating systems to plug the vulnerabilities Dorsey described."
Bruce
Trending Lyricist I
August 12, 2018
I agree completely with the need for passwords. I'll put up a post detailing my problems in another thread.
Lyricist I
October 26, 2018
Here to add to the huge list of people that want a password feature. It's absolutely ridiculous no such feature exists. I bet Sonos is storing our passwords in plain text on their systems too. I really worry about you guys!

Same issues as everyone else. Sonos is used in a business environment. Employees download the phone app and change the music when management is away. Hiring people is expensive and lecturing the staff across all our locations is a waste of resources. Sonos is obviously not designed to be used in a business environment.
Trending Lyricist I
October 27, 2018
What I see here is a customer requesting a simple thing, that is a single password option that might be helpful to many people.

And in the other side, there are people saying that there is no need and it is a particular request !

Come on guys! What is the matter to have this simple feature implemented??

Even if you don't believe that people would use it, don't say that no one would appreciate!

I don't need specifically this feature 99% of my time, but during parties at home, I would love ! Friends tend to bypass others in the set list and having the ability to avoid and control access, it would be very helpful!

Despite that, I don't see any harm to have the feature implemented as I don't see any problem to have now the ability to turn off wifi in my players.

Sonos, how difficult is to implement such feature??
controlav
Lead Maestro
October 27, 2018
I find it ironic that there are many threads demanding passport protection, and yet also many threads complaining about the requirement to register an account with Sonos. The pending security work will use that same account login to secure the communications to your devices. You cannot please all the people, all the time, clearly.

To use a Sonos system at a business location just put it all on a VLAN, and then only allow a limited few access to that VLAN. Problem solved.
Author of the leading independent Sonos apps for Android, MacOS, iOS, Windows and Xbox.
MikeV
October 27, 2018
There are just as many people here that want MORE security as there are that want LESS. Passwords are a pain. We all have more than enough of them. Even if Sonos were to just reuse the Sonos account password, it's still an annoyance to many to have to type it in to access things. Even moreso on the small screen of a phone.

And even if they add more security, they'll never secure EVERYTHING that everyone wants... then the complaint "Why didn't you add a password to [feature or function] too???!??!?". Like controlav said... you can't please all the people all the time. Maybe they just need to add a gazillion settings for "Security"... and just let everyone select how little or how much they want. THAT would be a great look for the app, don't ya think? A big list of items that you could turn password security on or off for.

"It's just a simple thing!"... no, it's not.
The S in IOT stands for Security.