Speaker password feature needed ASAP!

This thread originally had nothing to do with security issues, and people dumb enough to open port 1400 already lost us very valuable diagnostic tools. I'd hate to see what we lose next due to you attempting to cash in on security fears to get your personal wish for passwords to keep your kids from screwing up your volume and groupings.

Optional authentication, similar to what we see in Apple's HomePod, shouldn't cause you to lose anything you already have. Instead it provides security to those customers that need it.

I agree with the user chicks, that this is firstly a discipline issue. There is some slight paranoia also creeping into the thread about breaching the 'trusted private network' and it now being a threat from hackers. If the latter was the case, then I’m certainly not going to worry too much about password protecting my speakers, or echo devices, as neither of those things are going to harm me too much, comparitively speaking.

Even a passerby to my home, can shout commonly known Alexa instructions through a letter box, here in the UK, and I do try to cater for that type of scenario already, well as best I can, by switching off the microphones at the front of the home when we’re out and about. I switch the devices off altogether when we go on holiday. The external cameras would alert me anyway to anyone upto no good in this way (I hope). Kids shouting to Alexa through a letterbox though can be a pain, I guess, but it’s usually no worse than them knocking the front door and running away.

I think for the reasons stated, I would firstly look to discipline my kids and the next is, I would try to remember to switch off my mic or the accessible devices when away from home and if the network is hacked via the internet etc, then perhaps worry moreso about other things the hacker could get hold of, rather than just controlling the Sonos or Alexa system. If a user were at home, they would of course hear these things (Alexa commands) being used anyway.

Security of my music system and echo devices is probably the least of my worries, but I do try to think sensibly about all the potential issues.

The case of any kids in the house blasting out music and perhaps not doing as they are told, is easily solved, surely?

There is some slight paranoia also creeping into the thread about breaching the 'trusted private network' and it now being a threat from hackers. If the latter was the case, then I’m certainly not going to worry too much about password protecting my speakers, or echo devices, as neither of those things are going to harm me too much, comparitively speaking.
Internet connected devices have the capability to cause a great deal of harm if they are controlled by hackers. That is not paranoia, it is a fact that troubles those of us that work on security as part of our jobs.

The INTERNET OF THINGS (IOT) SECURITY BEST PRACTICES paper might be educational for you and others that believe it is OK to have unsecured devices on your networks.

https://internetinitiative.ieee.org/images/files/resources/white_papers/internet_of_things_may_2017.pdf

"5. Use strong authentication

IoT devices should not use easy-to-guess username/password credentials,
such as admin/admin. Devices should not use default credentials that are
invariant across multiple devices and should not include back doors and
debug-mode settings (secret credentials established by the device's
programmer) because, once guessed, they can be used to hack many
devices.

Each device should have a unique default username/password, perhaps
printed on its casing, and preferably resettable by the user. Passwords
should be sophisticated enough to resist educated guessing and so-called
brute force methods.

Where possible we recommend two-factor authentication (2FA), which
requires a user to employ both a password and another authentication form
that does not rely on user knowledge, such as a random code generated via
SMS text messaging. For IoT applications, we especially encourage the use
of context-aware authentication (CAA), also known as adaptive
authentication, which use contextual information and machine-learning
algorithms to continuously evaluate risk of malice without bother to the user
by demanding authentication. If risk is high, then the subscriber (or hacker)
would be asked for a multi-factor token to continue having access."

The case of any kids in the house blasting out music and perhaps not doing as they are told, is easily solved, surely?
I agree, all Sonos has to do is follow Apple's lead with the HomePod and give us the option to enable authentication. That addresses the many requests that Sonos has received for this feature.

They already have strong authentication when accessing Sonos from the outside. You cannot add a new unit and/or link a service account without authentication. So you can drop the "security" risk nonsense, it has already been plugged.

Of course this has nothing to do with adding permissions/passwords for features within the app itself.

Because Sonos devices lack authentication they are exposed to intruders using methods that no one outside of the hacker community is aware of!

But authentication isn't any guarantee that hackers won't find a way into your system, since we are talking in the realm of possible, not probable. Your very example illustrates that point since any hacker would first have to get past the wifi authentication before your hypothetical Sonos level authentication would be a factor. So you have a wall around your system that potentially has an unknown flaw in it, and you want to fix that potential problem bad adding a second that most likely would have the same unknown flaw?

They already have strict authentication when accessing Sonos from the outside. You cannot add a new unit and/or link a service account without authentication.

That protects a different part of the system. It doesn't do anything to keep someone with access to the network from gaining control of the hardware.

You and others are making the assumption that your network is secure and impenetrable. It is not, no network is, that is why it is very important to have device level authentication.

This thread originally had nothing to do with security issues, and people dumb enough to open port 1400 already lost us very valuable diagnostic tools. I'd hate to see what we lose next due to you attempting to cash in on security fears to get your personal wish for passwords to keep your kids from screwing up your volume and groupings.

You keep on saying open port 1400 to the outside world, and are missing the fact that the bulk of exploitation nowadays doesn’t work that way. Cross site scripting, infected documents, phishing messages and other client side exploits are the rule rather than the exception these days. If a malicious actor infects a legitimate site you connect to, say this one, and your browser downloads JavaScript, it could be used to access internal systems. OP is presenting a legitimate, verified and documented real world attack, and you keep dismissing him with the port 1400 argument.

@airforceteacher, I'm not following how that impacts Sonos. So you have a PC/mac/phone that's infected through the method you described. Can those then things then exploit your Sonos firmware in anyway? What is it about those exploits would be blocked by authentication on Sonos?

I'm not a security expert, honest question.

You keep on saying open port 1400 to the outside world, and are missing the fact that the bulk of exploitation nowadays doesn’t work that way. Cross site scripting, infected documents, phishing messages and other client side exploits are the rule rather than the exception these days. If a malicious actor infects a legitimate site you connect to, say this one, and your browser downloads JavaScript, it could be used to access internal systems. OP is presenting a legitimate, verified and documented real world attack, and you keep dismissing him with the port 1400 argument.

None of which has anything whatsoever to do with Sonos app or hardware, lol.