In the AMA thread I saw a post by u/Undergrid (assuming it's the same person here as there) that said that alll speakers now available on the public internet protected only by a users password. Do we have any more details on that? I didn't see where that info was buried among all the posts, but if that's true I feel like it deserves its own thread.
Bro wtf.
Nah not working 😆
You just gotta request the desktop site, then it’ll work. The layout is weird but if you turn to landscape you’ll get a better view and you can control everything from your phone without needing to be on the same network like you would with the app
Holy crap - all my PRIVATE playlists and INTERNAL ONLY media are uploaded to SONOS web site!
Local media isn’t uploaded, but controllable.
What are you talking about? I see all my playlist history all my favourites. I have nothing to hide, but I just dont want ANYTHING I PLAY on my LOCAL speakers to be ever send outside of my network... WHY?
The stuff sent is metadata, not the content itself. It's still not great. I'm unsure how long it's been doing this though as it sounds like play.sonos.com is plugging into infrastructure that already existed.
My speakers have personal names revealing family member names and other details. They have all been uploaded to Sonos servers on the internet!!
Like I said previously, I suspect this data was already being sent. This article suggests it's has been like this since at least 2020. https://www.gingerlime.com/2020/sonos-is-spying-on-me-and-you/
This is just more visible now.
Even without sonos account they would send all the metadata and custom speaker names to their servers? For what purpose?
Debugging possibly. Nobody other than Sonos could really tell you. I know you can send them system logs. It's possible that they can then go back and correlate the logs with this for debugging.
I don't like that data was being shared without that info being front and center, but I'm not surprised it is.
I realize we live in the day and age where everything is connected, we stream from Spotify, but having fully offline architecture was a main draw to Sonos ecosystem Now its gone.
What's more interesting here is the possible breaches of GDPR or misalignment to the DPF (the US Data Privacy Framework program).
I've not seen any NEW EULA that's needed to be agreed to here, so if the data being shared is different than before there's a possible question of legality here too (unless the original EULA we all agreed to was broad enough to include everything, but GDPR typically forbids such broad terms here).
Warning: Gonna get geeky here!
The DPF REPLACES the older US-EU Privacy Shield that was rendered unlawful after the Facebook vs Schrems case with Schrems winning (meaning that EU customer data could not lawfully, under GDPR, be transferred to US server infrastructure).
Has Sonos signed up and certified under the new DPF which came into play last year? Is EU data safe when transferred to clearly US server infra (a quick lookup shows play.sonos.com to be initially hosted in New York)?
I honestly do not know the answer here, and I'm kind of already sold on my data being in the cloud here so the above isn't that much of a concern to me (but it could be to others which is why I raise it).
My primary issue, as with many others, is around the (lack of) security here and the omission of MFA on our internal networked Sonos infra being exposed to the outside world.
This is the next wave of ‘What the hell?!’ when the rest of their tech base figures it out.
Customers: No 2FA? Sonos: Is /anything/ ever secure? Customers: What?!
💯% accurate
If this is a case its a SERIOUS issue as home speakers should NEVER be accessible out on the internet. Is there any confirmation of that? This was one of the main reasons I went with SONOS system that I was able to use them LOCALLY without any user IDs and passwords!
Go to play.sonos.com, have a look for yourself...
If you use it without being signed in, they are not controllable via WAN.
It’s just a relay service.
How can you adopt Sonos speaker now into the app without signing in. When you are in the app and try to add new speaker you are forced to sign in to Sonos account. I think with the new app Sonos made it a requirement to sign in. Unless I have missed something
I don’t know, you said that you use it that way. So you actually don’t?
Most of the cloud APIs are not new and were already there before. Until now I only discovered a handful which were not yet (officially) available to 3rd party apps.
alll speakers now available on the public internet protected only by a users password
That‘s not entirely true, they just connect to Sonos server (as they did for some time already) and only talk to the Sonos server. You can control them now via play.sonos.com. It’s just a relay service, it’s not like they face public internet - only Sonos servers face public internet.
I guess we get more details as time goes by.
Oh - and nothing get‘s uploaded. I can assure you that my upload speed is not fast enough to upload my whole local music library even within multiple days. It’s only metadata.
Someone can log into your account, without the need for passkeys or MFA, just a simple username and password and start your speakers playing.
In my account? No.
If they can log into your account, you should switch from a simple password and username to a more secure one. Use a password manager and generate a string of random characters, at least 16 and better more.
Yea because passwords never get leaked
If Sonos gets hacked, MFA isn’t gonna protect you. If they already have access to the server, no need to log into individual accounts.
And no, passwords don’t just magically get „leaked“. If you use one that was previously leaked, its kinda your fault. Modern password managers warn you of that.
Passwords absolutely get leaked. Have you never seen have I been pwned? How do you think password managers warn you about leaked passwords??
That’s not the point. If the password you use for Sonos only gets leaked then Sonos was already compromised and your leaked password doesn’t matter
Play.sonos.com - try it yourself. It’s just a matter of time until someone blast Techno on your speakers in the middle of the night. Or plays some horror stuff on the speaker of your kids.