Security on Kobo Accounts

[patrik]

Originally Posted by davidfor

A key is generated on the device when you do the setup. That is used for authentication when connecting to the server later.

If we can edit/remove that key maybe it's possible for some of the hackers here to create some sort of "dead-man-switch" which erases the key if you haven't opened a png (and/or book, or...) in a day or 7 or so.

Probably only for the paranoid, but then some always are.

[boriar]

@HRHReadsALot

May be you want to read that thread:

Password Protection

The protection level is not very high but may be enough for you.

[eenk]

When I first got my Kobo a few years ago and got to the account creation step, I wondered too what the security of the device and process would be. It's interesting to read that others come up with the same 3 item analysis as I did for myself. So, yeah, no big deal here. The shop were you used your credit card just yesterday may have a bad card reader firmware, or the electronic cash register has been tampered with too, so this is much more insecure than the Kobo device with its rather clear security. And from what I was told on security conferences about Banks or connected cars I personally would put my worries somewhere else, but not on a Kobo e-ink device. Unless is starts to listen to my rants while reading books...

[Cinisajoy]

On the buy books, even without a credit card one could get free books.
Ok, my evil mind just thought of how one could have some fun with a borrowed ereader.

Even with free books someone could sure mess with the recommendations.

[dmapr]

According to a poster on the Russian forums the 4.2.8432 (and subsequently the 4.3.8842) introduce a PIN option in the Privacy section. According to the poster, the quirk is that it only works when updating via factory reset. He noticed it appearing in 4.2.8432 but it disappeared after he updated to 4.3.8842. It came back again when he performed a factory reset and the 4.3.8842 got installed again.

[AnemicOak]

@HRHReadsALot, with the latest firmware you can add a PIN to your device. You can find out more in the thread about that firmware if interested...
https://www.mobileread.com/forums/sh...d.php?t=283866

[brit]

Originally Posted by HRHReadsALot

When is Kobo going to address this issue? I have a lot invested in my Kobo library and currently if I lose my eReader or it grts stolen, my account is completely accessible to anyone.

I agree with the kobo security problem. You have to remain logged in to read your books. If you log out your books disappear and you have to enter your email and password every time you want to read, and then wait for books to download each time.

If your kobo is stolen or left in an airport the person who has your kobo can go to the online store via your kobo and charge up books on your account simply by "confirming" the purchase because you are already signed into the account.

I solved the problem by purchasing a KINDLE e reader that allows you to DE-register and you still have all your books in your library. You can read any time and if the kindle is lost/stolen no one can access your account to buy stuff online. Your identity is protected. Too bad for kobo; I will no longer buy their books until they deal with the security issue.

[davidfor]

Originally Posted by brit

I agree with the kobo security problem. You have to remain logged in to read your books. If you log out your books disappear and you have to enter your email and password every time you want to read, and then wait for books to download each time.

If your kobo is stolen or left in an airport the person who has your kobo can go to the store via your kobo and charge up books on your account simply by "confirming" the purchase because you are already signed into the account. It creates a needless problem and also gives access to your name, address, email, phone number, your identity at kobo.com.

Did you read the rest of the thread explaining how little of an issue this really is and why? After all, you just need to remove the stored credit card and the finder cannot purchase books for you. And they cannot get the books off the device very easily.

I solved the problem by purchasing a KINDLE e reader that allows you to DE-register and you still have all your books in your library. You can read any time and if the kindle is lost/stolen no one can access your account to buy stuff online. Your identity is protected. Too bad for kobo; I will no longer buy their books until they deal with the security issue.

I can't for the life of me work out how this security issue leave my identity unprotected. The only piece of information on the device that can identify me us the email address that I used to register the account. OK, they can use that to sign me up for spam. But, as I'm the one who controls that email account, if they try to use it elsewhere, I'm going to be notified.

As to buying books now, as you do not use a Kobo device, you have no exposure to this problem. The issue is related to the Kobo device connected to an account. If there is no Kobo account connected, then you can buy books in safety and download the epub versions from the Kobo store.

And before you say anything: Yes, it is a security problem. And yes, Kobo should fix it. But, it is nowhere near as bad a problem as some are trying to make out.

[robko]

Originally Posted by brit

If your kobo is stolen or left in an airport the person who has your kobo ... [snip] .... It creates a needless problem and also gives access to your name, address, email, phone number, your identity at kobo.com.

I would challenge that. You can not access that level of account detail from your device. You need to log into the website to get more than your email address (your name doesn't even show up unless it's part of your email address). To quote directly from the device: "To view or change your account settings or payment info, please sign into www.kobo.com and select My Account". Please explain how I could that with just a logged in device?

If you are concerned about someone buying books on your account, fair enough (personally I don't see it as being a significant risk), but please stop claiming security concerns that are not valid like access to your address, name etc.

[Desdinova]

This almost smacks of someone who had a kobo for ten minutes and looked for a problem to moan about

[brit]

Originally Posted by davidfor

Did you read the rest of the thread explaining how little of an issue this really is and why? After all, you just need to remove the stored credit card and the finder cannot purchase books for you. And they cannot get the books off the device very easily.


I can't for the life of me work out how this security issue leave my identity unprotected. The only piece of information on the device that can identify me us the email address that I used to register the account. OK, they can use that to sign me up for spam. But, as I'm the one who controls that email account, if they try to use it elsewhere, I'm going to be notified.

As to buying books now, as you do not use a Kobo device, you have no exposure to this problem. The issue is related to the Kobo device connected to an account. If there is no Kobo account connected, then you can buy books in safety and download the epub versions from the Kobo store.

And before you say anything: Yes, it is a security problem. And yes, Kobo should fix it. But, it is nowhere near as bad a problem as some are trying to make out.

Thanks for your input. I edited my post re access to my identity and deleted my credit card info at kobo.com. That still leaves a possible thief with my email address, and possible sale of it for scams...

I am very pleased with my new Kindle ; common sense security is built into the reader that allows you to keep your library when signed out, DE-registered, and it includes a lock screen.

[Cinisajoy]

Originally Posted by brit

Thanks for your input. I edited my post re access to my identity and deleted my credit card info at kobo.com. That still leaves a possible thief with my email address, and possible sale of it for scams...

I am very pleased with my new Kindle ; common sense security is built into the reader that allows you to keep your library when signed out, DE-registered, and it includes a lock screen.

So do what many of us do. Set up a special email address just for KOBO.

[Desdinova]

Originally Posted by brit

Thanks for your input. I edited my post re access to my identity and deleted my credit card info at kobo.com. That still leaves a possible thief with my email address, and possible sale of it for scams...

I am very pleased with my new Kindle ; common sense security is built into the reader that allows you to keep your library when signed out, DE-registered, and it includes a lock screen.

Knowing your email address is virtually worthless. Your web browser probably leaks more information with every visit to a site.

And personally - I'd prefer not to give Amazon access to anything. I consider them a far worse company than Kobo.

[Desdinova]

And to be relevant - the time I had my bank account emptied was due to scammers GUESSING numbers (or so I was told by my bank).

The issue of security is important, but its also easy to vastly inflate the risk. If you do lose your kobo, then you should go to the website and change details. But that applies to if you lose your wallet/phone/<insert electronic device here>.

For example, there is a way to bypass the forced reset on android for example....

[koboy]

why is it so difficult for some people to grasp the simple concept of being able to password protect your e-reader so that the only person who can actually turn it on is YOU.

it seems to me to be a good optionally feature to have for those who want it, if it's good enough for a tablet and mobile phone etc then why not an e-reader as well.

best wishes koboy