What's this about?
A reader posted asking for a second opinion on the Microduck documentation. Their claim: the camera and microphone are reachable by anyone on the same network with no authentication, which the docs describe as acceptable in an office, and Wi-Fi credentials are exposed. Their reasoning for raising it is the sales number — this is a smash hit that will be in a lot of homes and offices next year.
What does "no auth on the same local network" mean in practice?
It means the device trusts your Wi-Fi. Anyone already on that network — a guest, a colleague, a compromised laptop, a smart TV with a vulnerability — can reach the camera and microphone without proving who they are. This is a very common shortcut in hobbyist hardware, where the local network is treated as a trust boundary. It stops being a reasonable assumption the moment the network has people on it you didn't personally vet.
How much weight should you give this?
- This is one reader's reading of the documentation, not a verified finding, not a CVE, and not a vendor response. Treat it as a lead.
- It is included here because the pattern is exactly what a source-level security scan is for: default-open local services and credentials in config, in a codebase about to be widely forked.
- The repo is Apache-2.0 and public, so the claim is directly checkable rather than something you have to take on trust.