13 ms·

What concerns me, as somebody who has absolutely zero interest in internet connected thermostats or fridges or whatever, is that as IoT devices become more and

by bane 11y ago

What concerns me, as somebody who has absolutely zero interest in internet connected thermostats or fridges or whatever, is that as IoT devices become more and more ubiquitous, I'll probably still end up with some kind of quasi-surveillance garbage in my house. Either because I didn't mean to purchase it, or because there was no alternative because in the future every under-sink garbage disposal requires a wi-fi connection or some nonsense. Due to smart phones, computers and tablets, I already have all my internet habits being recorded, and half a dozen cameras and microphones all over the house. Whats just as concerning is how many quasi-legitimate service providers, for reasons of people desperately trying to secure themselves from bad actors, end up finding technical solutions that are indistinguishable from malware and other kinds of network attacks/exfil techniques. Argh, this is a stupid future, I want to go back and try again.

reviseddamage 11y ago
From 1950: "What concerns me, as somebody who has absolutely zero interest in computers or electronics or whatever, is that as electronic devices become more and more ubiquitous, I'll probably still end up with some kind of quasi-electronic garbage in my house. Either because I didn't mean to purchase it, or because there was no alternative because in the future every under-sink washing apparatus requires electronic connection or some nonsense.
- function_seven 11y ago
  What point are you trying to make here? I don't see the parallels between OP's comment and yours.
Umn44 11y ago
" is that as IoT devices become more and more ubiquitous, I'll probably still end up with some kind of quasi-surveillance garbage in my house." This is the natural result of free market capitalism and private property, property owners (corporations) want to protect it and their profits from the plebians. So they buy the governments and strip plebians of their rights. Our brains are much worse at reality and thinking than thought. Science on reasoning: https://www.youtube.com/watch?v=PYmi0DLzBdQ https://www.youtube.com/watch?v=PYmi0DLzBdQ The (mass surveillance) by the NSA and abuse by law enforcement is just more part and parcel of state suppression of dissent against corporate interests. They're worried that the more people are going to wake up and corporate centers like the US and canada may be among those who also awaken. See this vid with Zbigniew Brzezinski, former United States National Security Advisor. https://www.youtube.com/watch?v=n7ZyJw_cHJY https://www.youtube.com/watch?v=n7ZyJw_cHJY Brezinski at a press conference https://www.youtube.com/watch?v=VWTIZBCQ79g https://www.youtube.com/watch?v=VWTIZBCQ79g Major powers, and imposing control over the awakened masses. https://youtu.be/4usbR_kKCDs?t=397 https://youtu.be/4usbR_kKCDs?t=397
manyxcxi 11y ago
It's not a stupid future at all. People thought home pages and the under construction guy GIF were stupid, now look where we are. There are some very asinine products on the market, there are so very many badly implemented products that throw security and privacy out the window, and there are some that are trying their best with what we have today. All of these are fleshing out the ideas that will stick for tomorrow... and hopefully are getting the user base familiar with the right questions to ask when looking at new stuff. The ability to reduce home energy usage, let people in remotely, get alerted to activity inside your house when you're on vacation, detect a leak or flood while away or asleep. These aren't stupid. Some of these will genuinely (attempt) to help the world, most of them are nice to have, but not stupid by any means. Where we're likely headed is that all of these individual devices don't need a direct connection to the Internet, but will have some local/mesh communication protocol to get the data to a main hub. Each local protocol will have security so that you can't sniff raw data just by being near the house, and the hub would use whatever the latest and greatest 'Internet security' offers up, a la TLS. This is pretty much how Z-Wave and ZigBee devices work with the more established home hubs from Mi Casa, Samsung (SmartThings), and Wink. We will continue to get burned by manufacturers in the near term. We will get burned by expensive, cheap, no name, and trusted brands. It's a growing pain, we don't have to accept it, but the majority of the products in the near term are going to be awful. Find reviews and analysis, create them yourself, or sit out, but your 'stupid future' is not going to magically stop marching into your house.
- deleted 11y ago
  [deleted]
- manyxcxi 11y ago
  In reply to a comment that was deleted (maybe it was getting downvoted?) I think (hope) the difference will be the utility to the the average user of these devices. We're basically in the infancy of IoT and are already seeing useful consumer grade devices. Going back to the home hubs as an example: You can grab a z-wave light switch from a big box store, a generic z-wave thermostat from Amazon, the hubs go from free to $200, and The only knowledge you need are to be able to replace a light switch in your house and the knowledge you would use to install a new WiFi router, you can have your outside lights come on only when it's dark outside and your thermostat respond to outside temperatures or vacancy just like Nest does. All in, you're less than the price of a Nest Thermostat, are (probably) more secure, and have a real shot at actually reducing your electric bills- and that's just with what we have right this second. Is it saving the world today? No. Is there WAY too much hype. Heck yes. Are there some REALLY useful devices out there today? Yeah, once you wade through the crop. Admittedly we're in the super early adopter phase, but there are real non-superficial benefits to making our biggest home energy appliances smarter with respect to consumption. There are attempts to interface with the power providers to have things like dishwashers and washing machines automatically wait for lower usage times to run- which means we can use slack in the energy network instead of firing up more coal or bringing more turbines online. It's a bit of a rosy picture as its well understood that residential use doesn't compare to local industrial use, but let's get any efficiency we can. As I've said to friends that are dubious on global warming- even if it's not a real threat, is it really a bad thing to use less energy and tear up less of our environment? Even if our residential efficiencies barely make a dent, assuming our privacy and security aren't completely compromised, is it bad to make our homes work just a little better?
gutnor 11y ago
There was a link on HN(?) a few days back about a guy that was testing some LED Light Bulb. Those light bulb are a bit clever as they need to plug into your wifi for remote control. He discovered that the plug was creating a new wifi network, with hardcoded simple password and security setting such that it exposed you internal network to an external attacker. I can't remember if it was calling home, but surely a future version will. So yeah, you will eventually end up with something connected, light bulbs are connected now !
- SixSigma 11y ago
  I don't know about the HN link but here's the article in question : https://mjg59.dreamwidth.org/40397.html https://mjg59.dreamwidth.org/40397.html And the list of things it does : So, in summary: it's a device that infringes my copyright, gives you root access in response to trivial credentials, has access control that depends entirely on nobody ever looking at the packets, is sufficiently poorly implemented that you can crash both it and the bulbs, has a cloud access protocol that has no security whatsoever and also acts as an easy mechanism for people to circumvent your network security.
  - at-fates-hands 11y ago
    I'm not paranoid or a conspiracy nut, but I can see where people would jump to the conclusion this is being done purposefully by the government to extend its blanket surveillance of the population. I may not be able to hack your iphone, but if I can get on your network through a rather easy means, it will give me access to what the information I really want and then correlate it with the rest of the information they can get from the carriers. I would imagine this is exactly the sort of soft target the NSA looks for.
    - davidhowlett 11y ago
      Hanlon's razor: "never attribute to malice that which is adequately explained by stupidity"
      - 11y ago
krylon 11y ago
Sadly, all of the IoT-devices I have read about so far are either deeply creepy (like that Barbie doll that records and transmits children's conversations to the mothership) or completely useless (like a razor that automatically orders new blades). And given the mediocre job we have done with online security so far, one can easily think of half a dozen scenarios for the "IoT" (the term alone makes me cringe) to turn in to security nightmare. Think of the Windows malware wave of 2003, when you could not install XP on an internet-connected machine without catching some worm before the installation was finished; now think of billions of lightbulbs, fridges, thermostats and whatnot and how much thought their designers must have put into security. Unless we wise up soon, the future is going to become very "interesting". EDIT: I just remembered one useful device - a networked smoke detector that the fire department remotely query to see e.g. what parts of a building a fire has spread to and that can tell a central computer when its battery runs out. I could imagine this being really, really useful often enough that it's worth it. But still, the security concern remains. (IIRC, the smoke detectors were not connected to the internet and did not use regular Wifi, which would make sense - if my living room is on fire, my internet connection and wifi router probably aren't so much working as ... liquified.)
- api 11y ago
  All the deeply creepy ones derive their creepiness from cloud tethering-- they transmit everything back to the mothership and can only be used via the mothership. You are putting a microphone, camera, etc. in your house that someone else has absolute real-time control over, and then because it's a "thing" you are going to forget it is there. Yet every single IoT kit, howto, stack-as-a-service, or other piece of material or IoT startup I see enshrines this as The Way. IoT devices connect to IoT cloud backends and that's how it's done. Period. There are several reasons: (1) Vendors desperately want to avoid total commoditization. Competition in the hardware space comes from cheap Chinese vendors with unbelievably cheap labor and monstrous economies of scale. Tethering your device to a backend provides both some amount of lock-in and keeps your secret sauce away from the Chinese reverse engineers. (Or so people think.) This is as true for Chinese vendors as it is for domestic ones-- don't expect them to forgo this strategy when their competition is each other. (2) There is no good solution for end-to-end transit that copes with the ugliness of endpoint networks. Full disclosure: I am founder of a company that is trying to address #2 in an open, scalable, reliable, and interoperable way. I am therefore partial to this problem. Yet I also think it may be the easier of the two to solve since it's mostly just a technical problem. Problem #1 is deeply baked into the structure of the market and I have no idea how to solve it. Pathological emergent behaviors like this in complex systems like markets are notoriously hard to fix. You can see the train wreck but you as an individual are helpless against it-- in fact you are almost forced to help drive the train off the cliff because every market incentive points that way. Usually the ham-fisted solution of legislation is the only thing that can address such pathologies in the real world. I hate that as a still-semi-libertarian but it is what it is. Edit: It gets worse. Now add: (3) All kinds of creepy agents from governments to crooks to (perhaps worst of all) quasi-crooked "dark pattern" companies who want to "monetize the user," would love to get as many Internet-connected cameras, microphones, sensors, etc. into your house as they can. It's a gold mine of private data they can do creepy things with. Think about the malware situation on PCs -- that is about to happen to your house. #1 and #3 obviously interact constructively. The race-to-the-bottom nature of hardware and the ease with which software is copied means that companies must look for any revenue stream they can. We've seen what this has done to the web: the most successful web companies are free services that monetize the user through surveillance. It's hard to imagine that the same economics won't drive IoT vendors to the same endpoint. Edit #2: I toy around with the deeply contrarian idea that what we need are significantly stronger intellectual property laws to upend this economic death spiral, but I am not at all convinced that that is the answer or that it would have any chance of working. The other less radical idea is that this is a marketing problem, and that IoT is ripe for a higher-end vendor to come in and say "we aren't creepy." Would customers pay twice as much for a genuinely useful or enjoyable IoT device that came with an iron clad privacy policy, open APIs, and direct connectivity so you could avoid any cloud dependency? The conventional wisdom that I hear endlessly repeated is "customers don't care about privacy or security." I see evidence of this myself -- e.g. not a single user out of many thousand has asked us (ZeroTier) about the quality of our crypto. "It's end to end encrypted!" With what? A software implementation of a cereal box cipher? Nobody cares. Yet I wonder: just how creepy do you have to get before people start caring? Do people care when Barbie is listening to their children? When their Amazon Echo is submitting the sound of them having sex to Amazon? How pitifully abusive and downright gross does our relationship with "the cloud" have to get before people actually start caring whether their doors are locked? Okay enough rant -- back to work trying to put a dent in this problem in a way that's probably more effective than posting to HN. #1 might be the harder of the two problems but if #2 isn't solved there is no chance of #1 being addressed.
imglorp 11y ago
I look forward to the future where I can come home and my space will welcome me individually, turning on lights, media, and climate to my personal preferences, and respond to "tea, earl gray, hot" at any time. My groceries and other expendables will replenish as they run low; menu planning will stock more. I'll get a chime when my kids arrive home, and another if their love interest show up after hours. Etc etc. All this information will be held strictly per my privacy settings and is fully encrypted when offsite. Now, the real question is, how do we get there, integrated and private, without selling out the whole stack to 100 different vendors with different API's, without one of them hacking the rest of your network, and without your government either hacking you, hacking one of those vendors, or just pressuring them for your data? I don't have an answer.
- mhurron 11y ago
  > the real question is, how do we get there, integrated and private, without selling out We don't, because people don't care.
  - StavrosK 11y ago
    This is the real (and depressing) answer. Same as our mobile phones, people will trade their privacy for a graph of how stocked their fridge is compared to other households.
    - pdkl95 11y ago
      People trade their privacy because they don't see any alternative. https://www.asc.upenn.edu/news-events/publications/tradeoff-fallacy-how-marketers-are-misrepresenting-american-consumers-and https://www.asc.upenn.edu/news-events/publications/tradeoff-... (or, in some cases, they don't understand how much privacy they are giving up)
- tremon 11y ago
  I'll get a chime when my kids arrive home, and another if their love interest show up after hours I imagine your kids (and potential interests) might have something to say about that. Taking that to its logical extreme, how is your desire to invasively monitor people in your care any different from what the government is doing?
jameshart 11y ago
People have been installing networked microphones in their homes since the 1890s. What is the change now that makes you concerned?
- arbuge 11y ago
  Big differnece. There was no software installable on "dumb" telephones. They could not be programmed remotely to change functionality to listening without ringing. That would have required an easily detectable hardware change. Smart devices on the other hand are always vulnerable to this possibility.
  - smokinjuan 11y ago
    Granted it took a bit more doing than nowadays, but the old phones had a mechanical ringer that is basically a microphone. No rewiring necessary. http://www.bugsweep.com/instrument.html http://www.bugsweep.com/instrument.html and https://www.schneier.com/blog/archives/2010/01/eavesdropping_i.html https://www.schneier.com/blog/archives/2010/01/eavesdropping...
- theandrewbailey 11y ago
  Most of these new microphones do not have physical switches that can be off and still be useful, and most do not have networking that can be killed by unplugging.
thearn4 11y ago
As someone who has played around with home automation and done some homebrew IoT, my biggest concern to be honest is that the extra functionality will make common appliances more difficult to maintain than they already are.
- troycarlson 11y ago
  Right, maintaining a dozen sensors and integrations with other appliances is a pain in the ass. Also, I have no interest in moving the controls of the device from the appliance to my smartphone. 95% of the time it's more work to pull out my phone and launch an app than to flick a physical light switch.
- gherkin0 11y ago
  Yeah, exactly. I really don't want an internet-connected IoT refrigerator, but I wouldn't mind one with some standardized interface that allows it to be optionally augmented with IoT functionality of my choosing. That interface shouldn't be much more complicated that some connectors and passive wiring. Then I could connect a communications and sensor modules and replace them independently as needed.
draw_down 11y ago
Yeah, that's kinda how I feel about our democracy.
pizza234 11y ago
I agree on general terms, but not necessarily in practice. Fortunately, market segmentation relegates certain features, network/internet connection being one of them, to the high-end/luxury segment. It may take a (relatively) long time before network/internet will be so cheap that it will permeate down to the lower segment; considering also that being connected requires a backing infrastructure, which is cost added, I think this time will be very very long.
- baldfat 11y ago
  The Barbie Doll incident kind of jump started this on a non-Luxury item. Also surprised no one posted the video of the guy on tech support phone call while his webcam was hacked and playing The Police "Every Breath You Take." https://www.youtube.com/watch?v=CUx8_JNNKsM https://www.youtube.com/watch?v=CUx8_JNNKsM
mindslight 11y ago
I agree with the sentiment, especially with regards to terrible ideas like touchscreens. But open up any "smart appliance" and you'll still find the same simplistic sensors and actuators performing the core function. If things get bad enough a modding market will spring up, replacing "intelligent" control boards with versions that work for the user. Likely with non-mandatory network capability, but without the hostility.
raldu 11y ago
> for reasons of people desperately trying to secure themselves from bad actors, end up finding technical solutions that are indistinguishable from malware and other kinds of network attacks/exfil techniques. Additionally, IoT security "solutions" can actually be worse than a malware. Here is a recent example: Password Extraction Via Front Doorbell http://hackaday.com/2016/02/28/password-extraction-via-front-doorbell/ http://hackaday.com/2016/02/28/password-extraction-via-front...
bsbechtel 11y ago
>>is that as IoT devices become more and more ubiquitous, I'll probably still end up with some kind of quasi-surveillance garbage in my house You mean like Google and Facebook with the web?
rsync 11y ago
I also have zero interest and would also be alarmed to have a bunch of transmitters and protocols and services running, possibly invisibly, in my home. However, I am not particularly worried and that is because there will always be industrial/commercial models. I know this because it is the case with flat panel displays. We are certainly well over the transition to "smart" TVs and all of their accompanying features - you probably can't buy a single display at Best Buy that isn't "smart". However, you can also buy an extremely well built, completely dumb "signage display" (like those thin-bezel NEC models you see airports use for departure/arrival boards, or what video walls are made of). They aren't even much more expensive, since the buyers (airports and shopping malls) need economies of scale when they are buying 200 of them at a time. They last longer, are more rugged ... and are completely dumb. The same is true with commercial refrigerators and ranges, etc. - pro cooks in a kitchen can't be dealing with the wifi or the facebook integration. I am very optimistic that this will always be the case and that "dumb" models will be available to smart people for a small premium. It's also easy to predict that lack of smart features (and screens and lights and boopity-beeps) will be a subtle class distinction. When everyone in the trailer park has a flat panel on their refrigerator, you'll see them disappear from the highest end models.
- erelde 11y ago
  But if that's the case, we run into a problem I saw someone write about with the ongoing Apple VS FBI case, only the "rich" would have access to strong encryption/privacy... If I remember who talked about that I'll edit this message.
  - rsync 11y ago
    That may be the case with privacy, or other intangibles like that, but we're talking about electronics. As I said, the airports (or the commercial kitchens, or the industrial lighting consumers) need to buy these things in bulk, so the prices get driven down. Yes, a brand new NEC displaywall panel purchased quantity 1 might cost 20% or even 100% more than a panel at best buy, but go backwards one revision and its as cheap as any electronics. In this case it's not "the rich" but rather the informed, or the savvy.
merpnderp 11y ago
Since it is getting harder to find devices that aren't "smart", I've decided to stop worrying about it and simply not connect them to my network. I assume if they automatically search out unsecured wireless, I'll be able to sue them, since accessing networks without permission is illegal. As long as what I want them to do (be a refrigerator, a tv, or a thermostat) isn't dependent on network connectivity, the "smart" device isn't much of a threat.
hackuser 11y ago
I agree; my main concern is that at least I need to have a choice, to be able to opt-out. However, if your electric company already uses smart meters, which capture your power usage at a high resolution, they can determine a lot of what goes on in your home already: They can see what machines are on or off (they have different power signatures), even what TV show you are watching (again, based on the power signature), and make good guesses about when you are home, awake/asleep, how many people are there, etc. If you are less busy than I am at the moment, you can find reports from the Congressional Research Service, Colorado Public Utility Commission, ad IIRC MIT and the Dept of Energy detailing this (I think the CRS report references the others and is a good place to start.)
anexprogrammer 11y ago
Yep that's my concern too. I'd actually go for a little home automation, perhaps a Philips Hue or two if they were LAN only. 99% of these things should be blocking WAN access. Even the smartphone apps should be limiting themselves to never be on the net. Unlike gmail and facebook actions driving ads, I fail to see what manufacturers get out of the data from when I use my fridge, toothbrush or thermostat. Seriously, I don't see what earthly use it is for them, unless next step is an ad driven toothbrush. Every time I see an article about what's been found on Shodan I shudder. It's a very stupid future.
- lfowles 11y ago
  > toothbrush Incentive for dentists to recommend their internet enabled toothbrush so they can suggest specific brushing plans and monitor how well the person has been adhering to their regular brushing. There might also be some software on the dentist side for managing all of this. I have one of these toothbrushes, that's roughly pulled from the features section of the manual. (I have it because I can track how well I keep to brushing my teeth over time, well worth the ounce of prevention.) > thermostat The local power company has a program where they supply a smart thermostat that they can regulate during peak use. With certain caveats of course, I think you can opt out of the automatic regulation several times a month. > fridge Haven't seen a practical use for this yet.
  - anexprogrammer 11y ago
    > so they can suggest specific brushing plans For me that's a hell of a stretch. Just seems hellishly complex for checking the preferred 2 mins of brushing. Timer sure, especially for the kids. But, if people see real benefit... > thermostat that they can regulate during peak use OK, that's a benefit that's difficult to fault. Wasn't aware of any doing that.
  - kefka 11y ago
    I have a recent Samsung refrigerator, which has a nasty habit of forming ice in the fan blades. Samsung refuses to further warranty it.... So, I use 2 thermistors and a photoresistor and equipped them in my fridge. I used an Arduino Nano clone with a nRF24L01+ chip and MySensors library for getting data. The data then is posted to my MQTT server (Mosquitto) and also saved in a file. The file is parsed by a graph library and is displayed on my http://[hash].onion/fridge http://[hash].onion/fridge . Also, if I detect >45f or higher after last fridge door open event, I throw an alarm (chirp on piezo speaker and email). And yes, It's saved us at least 1 fridge load of groceries. We can't afford to buy a fridge every 3 years, even though throw-away culture sure would want us to.
willholloway 11y ago
Would you buy soundproof cases to leave some of these miced devices in when not in use? Like the amazon fire remote?
dickbasedregex 11y ago
Great. Waste more time/resources/etc and make products even more fragile than they already are. For what? Some nonsense that will mostly die out as people realize toasters don't need to talk to anything. Awesome. Consumer electronics seem to get worse as fast as they get "better."
kenshaw 11y ago
To fix this, the Federal government (most likely the FCC) needs to publish rules and regulations regarding the "telemetry" that software and hardware is allowed to collect and to issue recommendations / requirements that the consumer have full control and be able to disable all features of that "telemetry" and that the consumer's right to do so cannot be waived or abridged via a terms of service agreement or some other such (ie, the behavior cannot be automatically enabled after a systems update, nor can additional or new "telemetry" that didn't exist in the original product be added via a systems update and be enabled by default). Additionally, it should be a requirement that all hardware / software vendors be required to disclose all host(s) and points of origin that telemetry is collected and these hosts should be registered with the FCC. The points of location where that data is collected needs to be regulated under similar security information rules/laws that surround HIPAA. Any device/software not complying should not be allowed for sale within US borders. Additionally, any vendor who accidentally breaks that (ie, Microsoft "accidentally" pushing auto-updates that automatically reenable "telemetry") need to be punished with large and punitive fines (ie, $1,000 per violation/instance). Additionally, it should be mandated that any "telemetry" system cannot impair, disable, or otherwise render the device inoperable should the telemetry 1) be shut down, 2) fail. There should also be punitive fines for this. Barring this, this is only going to get worse and worse as time goes on. A bigger concern for me, is that since all this software / hardware is being built in the purview of repressive regimes (the US government not withstanding), that government actors will employ or dictate methods by which they can tap that "telemetry" without a court order. It is important that the US pass these laws, as the majority of software that goes into these devices is built in the US (and, also, since the US is still the single largest market for them). If laws are passed in other countries, because of the cowboy mentality in the US (see: Uber, Facebook, Google, Microsoft in Europe, et al), I highly doubt there is any hope for self-regulation within the software industry itself, and that government intervention is necessary in this case.

by bane 11y ago

reviseddamage 11y ago

From 1950: "What concerns me, as somebody who has absolutely zero interest in computers or electronics or whatever, is that as electronic devices become more and more ubiquitous, I'll probably still end up with some kind of quasi-electronic garbage in my house. Either because I didn't mean to purchase it, or because there was no alternative because in the future every under-sink washing apparatus requires electronic connection or some nonsense.

function_seven 11y ago
What point are you trying to make here? I don't see the parallels between OP's comment and yours.

Umn44 11y ago

" is that as IoT devices become more and more ubiquitous, I'll probably still end up with some kind of quasi-surveillance garbage in my house." This is the natural result of free market capitalism and private property, property owners (corporations) want to protect it and their profits from the plebians. So they buy the governments and strip plebians of their rights. Our brains are much worse at reality and thinking than thought. Science on reasoning: https://www.youtube.com/watch?v=PYmi0DLzBdQ https://www.youtube.com/watch?v=PYmi0DLzBdQ The (mass surveillance) by the NSA and abuse by law enforcement is just more part and parcel of state suppression of dissent against corporate interests. They're worried that the more people are going to wake up and corporate centers like the US and canada may be among those who also awaken. See this vid with Zbigniew Brzezinski, former United States National Security Advisor. https://www.youtube.com/watch?v=n7ZyJw_cHJY https://www.youtube.com/watch?v=n7ZyJw_cHJY Brezinski at a press conference https://www.youtube.com/watch?v=VWTIZBCQ79g https://www.youtube.com/watch?v=VWTIZBCQ79g Major powers, and imposing control over the awakened masses. https://youtu.be/4usbR_kKCDs?t=397 https://youtu.be/4usbR_kKCDs?t=397

manyxcxi 11y ago

It's not a stupid future at all. People thought home pages and the under construction guy GIF were stupid, now look where we are. There are some very asinine products on the market, there are so very many badly implemented products that throw security and privacy out the window, and there are some that are trying their best with what we have today. All of these are fleshing out the ideas that will stick for tomorrow... and hopefully are getting the user base familiar with the right questions to ask when looking at new stuff. The ability to reduce home energy usage, let people in remotely, get alerted to activity inside your house when you're on vacation, detect a leak or flood while away or asleep. These aren't stupid. Some of these will genuinely (attempt) to help the world, most of them are nice to have, but not stupid by any means. Where we're likely headed is that all of these individual devices don't need a direct connection to the Internet, but will have some local/mesh communication protocol to get the data to a main hub. Each local protocol will have security so that you can't sniff raw data just by being near the house, and the hub would use whatever the latest and greatest 'Internet security' offers up, a la TLS. This is pretty much how Z-Wave and ZigBee devices work with the more established home hubs from Mi Casa, Samsung (SmartThings), and Wink. We will continue to get burned by manufacturers in the near term. We will get burned by expensive, cheap, no name, and trusted brands. It's a growing pain, we don't have to accept it, but the majority of the products in the near term are going to be awful. Find reviews and analysis, create them yourself, or sit out, but your 'stupid future' is not going to magically stop marching into your house.

deleted 11y ago
[deleted]
manyxcxi 11y ago
In reply to a comment that was deleted (maybe it was getting downvoted?) I think (hope) the difference will be the utility to the the average user of these devices. We're basically in the infancy of IoT and are already seeing useful consumer grade devices. Going back to the home hubs as an example: You can grab a z-wave light switch from a big box store, a generic z-wave thermostat from Amazon, the hubs go from free to $200, and The only knowledge you need are to be able to replace a light switch in your house and the knowledge you would use to install a new WiFi router, you can have your outside lights come on only when it's dark outside and your thermostat respond to outside temperatures or vacancy just like Nest does. All in, you're less than the price of a Nest Thermostat, are (probably) more secure, and have a real shot at actually reducing your electric bills- and that's just with what we have right this second. Is it saving the world today? No. Is there WAY too much hype. Heck yes. Are there some REALLY useful devices out there today? Yeah, once you wade through the crop. Admittedly we're in the super early adopter phase, but there are real non-superficial benefits to making our biggest home energy appliances smarter with respect to consumption. There are attempts to interface with the power providers to have things like dishwashers and washing machines automatically wait for lower usage times to run- which means we can use slack in the energy network instead of firing up more coal or bringing more turbines online. It's a bit of a rosy picture as its well understood that residential use doesn't compare to local industrial use, but let's get any efficiency we can. As I've said to friends that are dubious on global warming- even if it's not a real threat, is it really a bad thing to use less energy and tear up less of our environment? Even if our residential efficiencies barely make a dent, assuming our privacy and security aren't completely compromised, is it bad to make our homes work just a little better?

gutnor 11y ago

There was a link on HN(?) a few days back about a guy that was testing some LED Light Bulb. Those light bulb are a bit clever as they need to plug into your wifi for remote control. He discovered that the plug was creating a new wifi network, with hardcoded simple password and security setting such that it exposed you internal network to an external attacker. I can't remember if it was calling home, but surely a future version will. So yeah, you will eventually end up with something connected, light bulbs are connected now !

SixSigma 11y ago
I don't know about the HN link but here's the article in question : https://mjg59.dreamwidth.org/40397.html https://mjg59.dreamwidth.org/40397.html And the list of things it does : So, in summary: it's a device that infringes my copyright, gives you root access in response to trivial credentials, has access control that depends entirely on nobody ever looking at the packets, is sufficiently poorly implemented that you can crash both it and the bulbs, has a cloud access protocol that has no security whatsoever and also acts as an easy mechanism for people to circumvent your network security.
- at-fates-hands 11y ago
  I'm not paranoid or a conspiracy nut, but I can see where people would jump to the conclusion this is being done purposefully by the government to extend its blanket surveillance of the population. I may not be able to hack your iphone, but if I can get on your network through a rather easy means, it will give me access to what the information I really want and then correlate it with the rest of the information they can get from the carriers. I would imagine this is exactly the sort of soft target the NSA looks for.
  - davidhowlett 11y ago
    Hanlon's razor: "never attribute to malice that which is adequately explained by stupidity"
    - 11y ago

krylon 11y ago

Sadly, all of the IoT-devices I have read about so far are either deeply creepy (like that Barbie doll that records and transmits children's conversations to the mothership) or completely useless (like a razor that automatically orders new blades). And given the mediocre job we have done with online security so far, one can easily think of half a dozen scenarios for the "IoT" (the term alone makes me cringe) to turn in to security nightmare. Think of the Windows malware wave of 2003, when you could not install XP on an internet-connected machine without catching some worm before the installation was finished; now think of billions of lightbulbs, fridges, thermostats and whatnot and how much thought their designers must have put into security. Unless we wise up soon, the future is going to become very "interesting". EDIT: I just remembered one useful device - a networked smoke detector that the fire department remotely query to see e.g. what parts of a building a fire has spread to and that can tell a central computer when its battery runs out. I could imagine this being really, really useful often enough that it's worth it. But still, the security concern remains. (IIRC, the smoke detectors were not connected to the internet and did not use regular Wifi, which would make sense - if my living room is on fire, my internet connection and wifi router probably aren't so much working as ... liquified.)

api 11y ago
All the deeply creepy ones derive their creepiness from cloud tethering-- they transmit everything back to the mothership and can only be used via the mothership. You are putting a microphone, camera, etc. in your house that someone else has absolute real-time control over, and then because it's a "thing" you are going to forget it is there. Yet every single IoT kit, howto, stack-as-a-service, or other piece of material or IoT startup I see enshrines this as The Way. IoT devices connect to IoT cloud backends and that's how it's done. Period. There are several reasons: (1) Vendors desperately want to avoid total commoditization. Competition in the hardware space comes from cheap Chinese vendors with unbelievably cheap labor and monstrous economies of scale. Tethering your device to a backend provides both some amount of lock-in and keeps your secret sauce away from the Chinese reverse engineers. (Or so people think.) This is as true for Chinese vendors as it is for domestic ones-- don't expect them to forgo this strategy when their competition is each other. (2) There is no good solution for end-to-end transit that copes with the ugliness of endpoint networks. Full disclosure: I am founder of a company that is trying to address #2 in an open, scalable, reliable, and interoperable way. I am therefore partial to this problem. Yet I also think it may be the easier of the two to solve since it's mostly just a technical problem. Problem #1 is deeply baked into the structure of the market and I have no idea how to solve it. Pathological emergent behaviors like this in complex systems like markets are notoriously hard to fix. You can see the train wreck but you as an individual are helpless against it-- in fact you are almost forced to help drive the train off the cliff because every market incentive points that way. Usually the ham-fisted solution of legislation is the only thing that can address such pathologies in the real world. I hate that as a still-semi-libertarian but it is what it is. Edit: It gets worse. Now add: (3) All kinds of creepy agents from governments to crooks to (perhaps worst of all) quasi-crooked "dark pattern" companies who want to "monetize the user," would love to get as many Internet-connected cameras, microphones, sensors, etc. into your house as they can. It's a gold mine of private data they can do creepy things with. Think about the malware situation on PCs -- that is about to happen to your house. #1 and #3 obviously interact constructively. The race-to-the-bottom nature of hardware and the ease with which software is copied means that companies must look for any revenue stream they can. We've seen what this has done to the web: the most successful web companies are free services that monetize the user through surveillance. It's hard to imagine that the same economics won't drive IoT vendors to the same endpoint. Edit #2: I toy around with the deeply contrarian idea that what we need are significantly stronger intellectual property laws to upend this economic death spiral, but I am not at all convinced that that is the answer or that it would have any chance of working. The other less radical idea is that this is a marketing problem, and that IoT is ripe for a higher-end vendor to come in and say "we aren't creepy." Would customers pay twice as much for a genuinely useful or enjoyable IoT device that came with an iron clad privacy policy, open APIs, and direct connectivity so you could avoid any cloud dependency? The conventional wisdom that I hear endlessly repeated is "customers don't care about privacy or security." I see evidence of this myself -- e.g. not a single user out of many thousand has asked us (ZeroTier) about the quality of our crypto. "It's end to end encrypted!" With what? A software implementation of a cereal box cipher? Nobody cares. Yet I wonder: just how creepy do you have to get before people start caring? Do people care when Barbie is listening to their children? When their Amazon Echo is submitting the sound of them having sex to Amazon? How pitifully abusive and downright gross does our relationship with "the cloud" have to get before people actually start caring whether their doors are locked? Okay enough rant -- back to work trying to put a dent in this problem in a way that's probably more effective than posting to HN. #1 might be the harder of the two problems but if #2 isn't solved there is no chance of #1 being addressed.

imglorp 11y ago

I look forward to the future where I can come home and my space will welcome me individually, turning on lights, media, and climate to my personal preferences, and respond to "tea, earl gray, hot" at any time. My groceries and other expendables will replenish as they run low; menu planning will stock more. I'll get a chime when my kids arrive home, and another if their love interest show up after hours. Etc etc. All this information will be held strictly per my privacy settings and is fully encrypted when offsite. Now, the real question is, how do we get there, integrated and private, without selling out the whole stack to 100 different vendors with different API's, without one of them hacking the rest of your network, and without your government either hacking you, hacking one of those vendors, or just pressuring them for your data? I don't have an answer.

mhurron 11y ago
> the real question is, how do we get there, integrated and private, without selling out We don't, because people don't care.
- StavrosK 11y ago
  This is the real (and depressing) answer. Same as our mobile phones, people will trade their privacy for a graph of how stocked their fridge is compared to other households.
  - pdkl95 11y ago
    People trade their privacy because they don't see any alternative. https://www.asc.upenn.edu/news-events/publications/tradeoff-fallacy-how-marketers-are-misrepresenting-american-consumers-and https://www.asc.upenn.edu/news-events/publications/tradeoff-... (or, in some cases, they don't understand how much privacy they are giving up)
tremon 11y ago
I'll get a chime when my kids arrive home, and another if their love interest show up after hours I imagine your kids (and potential interests) might have something to say about that. Taking that to its logical extreme, how is your desire to invasively monitor people in your care any different from what the government is doing?

jameshart 11y ago

People have been installing networked microphones in their homes since the 1890s. What is the change now that makes you concerned?

arbuge 11y ago
Big differnece. There was no software installable on "dumb" telephones. They could not be programmed remotely to change functionality to listening without ringing. That would have required an easily detectable hardware change. Smart devices on the other hand are always vulnerable to this possibility.
- smokinjuan 11y ago
  Granted it took a bit more doing than nowadays, but the old phones had a mechanical ringer that is basically a microphone. No rewiring necessary. http://www.bugsweep.com/instrument.html http://www.bugsweep.com/instrument.html and https://www.schneier.com/blog/archives/2010/01/eavesdropping_i.html https://www.schneier.com/blog/archives/2010/01/eavesdropping...
theandrewbailey 11y ago
Most of these new microphones do not have physical switches that can be off and still be useful, and most do not have networking that can be killed by unplugging.

thearn4 11y ago

As someone who has played around with home automation and done some homebrew IoT, my biggest concern to be honest is that the extra functionality will make common appliances more difficult to maintain than they already are.

troycarlson 11y ago
Right, maintaining a dozen sensors and integrations with other appliances is a pain in the ass. Also, I have no interest in moving the controls of the device from the appliance to my smartphone. 95% of the time it's more work to pull out my phone and launch an app than to flick a physical light switch.
gherkin0 11y ago
Yeah, exactly. I really don't want an internet-connected IoT refrigerator, but I wouldn't mind one with some standardized interface that allows it to be optionally augmented with IoT functionality of my choosing. That interface shouldn't be much more complicated that some connectors and passive wiring. Then I could connect a communications and sensor modules and replace them independently as needed.

draw_down 11y ago

Yeah, that's kinda how I feel about our democracy.

pizza234 11y ago

I agree on general terms, but not necessarily in practice. Fortunately, market segmentation relegates certain features, network/internet connection being one of them, to the high-end/luxury segment. It may take a (relatively) long time before network/internet will be so cheap that it will permeate down to the lower segment; considering also that being connected requires a backing infrastructure, which is cost added, I think this time will be very very long.

baldfat 11y ago
The Barbie Doll incident kind of jump started this on a non-Luxury item. Also surprised no one posted the video of the guy on tech support phone call while his webcam was hacked and playing The Police "Every Breath You Take." https://www.youtube.com/watch?v=CUx8_JNNKsM https://www.youtube.com/watch?v=CUx8_JNNKsM

mindslight 11y ago

I agree with the sentiment, especially with regards to terrible ideas like touchscreens. But open up any "smart appliance" and you'll still find the same simplistic sensors and actuators performing the core function. If things get bad enough a modding market will spring up, replacing "intelligent" control boards with versions that work for the user. Likely with non-mandatory network capability, but without the hostility.

raldu 11y ago

> for reasons of people desperately trying to secure themselves from bad actors, end up finding technical solutions that are indistinguishable from malware and other kinds of network attacks/exfil techniques. Additionally, IoT security "solutions" can actually be worse than a malware. Here is a recent example: Password Extraction Via Front Doorbell http://hackaday.com/2016/02/28/password-extraction-via-front-doorbell/ http://hackaday.com/2016/02/28/password-extraction-via-front...

bsbechtel 11y ago

>>is that as IoT devices become more and more ubiquitous, I'll probably still end up with some kind of quasi-surveillance garbage in my house You mean like Google and Facebook with the web?

rsync 11y ago

I also have zero interest and would also be alarmed to have a bunch of transmitters and protocols and services running, possibly invisibly, in my home. However, I am not particularly worried and that is because there will always be industrial/commercial models. I know this because it is the case with flat panel displays. We are certainly well over the transition to "smart" TVs and all of their accompanying features - you probably can't buy a single display at Best Buy that isn't "smart". However, you can also buy an extremely well built, completely dumb "signage display" (like those thin-bezel NEC models you see airports use for departure/arrival boards, or what video walls are made of). They aren't even much more expensive, since the buyers (airports and shopping malls) need economies of scale when they are buying 200 of them at a time. They last longer, are more rugged ... and are completely dumb. The same is true with commercial refrigerators and ranges, etc. - pro cooks in a kitchen can't be dealing with the wifi or the facebook integration. I am very optimistic that this will always be the case and that "dumb" models will be available to smart people for a small premium. It's also easy to predict that lack of smart features (and screens and lights and boopity-beeps) will be a subtle class distinction. When everyone in the trailer park has a flat panel on their refrigerator, you'll see them disappear from the highest end models.

erelde 11y ago
But if that's the case, we run into a problem I saw someone write about with the ongoing Apple VS FBI case, only the "rich" would have access to strong encryption/privacy... If I remember who talked about that I'll edit this message.
- rsync 11y ago
  That may be the case with privacy, or other intangibles like that, but we're talking about electronics. As I said, the airports (or the commercial kitchens, or the industrial lighting consumers) need to buy these things in bulk, so the prices get driven down. Yes, a brand new NEC displaywall panel purchased quantity 1 might cost 20% or even 100% more than a panel at best buy, but go backwards one revision and its as cheap as any electronics. In this case it's not "the rich" but rather the informed, or the savvy.

merpnderp 11y ago

Since it is getting harder to find devices that aren't "smart", I've decided to stop worrying about it and simply not connect them to my network. I assume if they automatically search out unsecured wireless, I'll be able to sue them, since accessing networks without permission is illegal. As long as what I want them to do (be a refrigerator, a tv, or a thermostat) isn't dependent on network connectivity, the "smart" device isn't much of a threat.

hackuser 11y ago

I agree; my main concern is that at least I need to have a choice, to be able to opt-out. However, if your electric company already uses smart meters, which capture your power usage at a high resolution, they can determine a lot of what goes on in your home already: They can see what machines are on or off (they have different power signatures), even what TV show you are watching (again, based on the power signature), and make good guesses about when you are home, awake/asleep, how many people are there, etc. If you are less busy than I am at the moment, you can find reports from the Congressional Research Service, Colorado Public Utility Commission, ad IIRC MIT and the Dept of Energy detailing this (I think the CRS report references the others and is a good place to start.)

anexprogrammer 11y ago

Yep that's my concern too. I'd actually go for a little home automation, perhaps a Philips Hue or two if they were LAN only. 99% of these things should be blocking WAN access. Even the smartphone apps should be limiting themselves to never be on the net. Unlike gmail and facebook actions driving ads, I fail to see what manufacturers get out of the data from when I use my fridge, toothbrush or thermostat. Seriously, I don't see what earthly use it is for them, unless next step is an ad driven toothbrush. Every time I see an article about what's been found on Shodan I shudder. It's a very stupid future.

lfowles 11y ago
> toothbrush Incentive for dentists to recommend their internet enabled toothbrush so they can suggest specific brushing plans and monitor how well the person has been adhering to their regular brushing. There might also be some software on the dentist side for managing all of this. I have one of these toothbrushes, that's roughly pulled from the features section of the manual. (I have it because I can track how well I keep to brushing my teeth over time, well worth the ounce of prevention.) > thermostat The local power company has a program where they supply a smart thermostat that they can regulate during peak use. With certain caveats of course, I think you can opt out of the automatic regulation several times a month. > fridge Haven't seen a practical use for this yet.
- anexprogrammer 11y ago
  > so they can suggest specific brushing plans For me that's a hell of a stretch. Just seems hellishly complex for checking the preferred 2 mins of brushing. Timer sure, especially for the kids. But, if people see real benefit... > thermostat that they can regulate during peak use OK, that's a benefit that's difficult to fault. Wasn't aware of any doing that.
- kefka 11y ago
  I have a recent Samsung refrigerator, which has a nasty habit of forming ice in the fan blades. Samsung refuses to further warranty it.... So, I use 2 thermistors and a photoresistor and equipped them in my fridge. I used an Arduino Nano clone with a nRF24L01+ chip and MySensors library for getting data. The data then is posted to my MQTT server (Mosquitto) and also saved in a file. The file is parsed by a graph library and is displayed on my http://[hash].onion/fridge http://[hash].onion/fridge . Also, if I detect >45f or higher after last fridge door open event, I throw an alarm (chirp on piezo speaker and email). And yes, It's saved us at least 1 fridge load of groceries. We can't afford to buy a fridge every 3 years, even though throw-away culture sure would want us to.

willholloway 11y ago

Would you buy soundproof cases to leave some of these miced devices in when not in use? Like the amazon fire remote?

dickbasedregex 11y ago

Great. Waste more time/resources/etc and make products even more fragile than they already are. For what? Some nonsense that will mostly die out as people realize toasters don't need to talk to anything. Awesome. Consumer electronics seem to get worse as fast as they get "better."

kenshaw 11y ago

To fix this, the Federal government (most likely the FCC) needs to publish rules and regulations regarding the "telemetry" that software and hardware is allowed to collect and to issue recommendations / requirements that the consumer have full control and be able to disable all features of that "telemetry" and that the consumer's right to do so cannot be waived or abridged via a terms of service agreement or some other such (ie, the behavior cannot be automatically enabled after a systems update, nor can additional or new "telemetry" that didn't exist in the original product be added via a systems update and be enabled by default). Additionally, it should be a requirement that all hardware / software vendors be required to disclose all host(s) and points of origin that telemetry is collected and these hosts should be registered with the FCC. The points of location where that data is collected needs to be regulated under similar security information rules/laws that surround HIPAA. Any device/software not complying should not be allowed for sale within US borders. Additionally, any vendor who accidentally breaks that (ie, Microsoft "accidentally" pushing auto-updates that automatically reenable "telemetry") need to be punished with large and punitive fines (ie, $1,000 per violation/instance). Additionally, it should be mandated that any "telemetry" system cannot impair, disable, or otherwise render the device inoperable should the telemetry 1) be shut down, 2) fail. There should also be punitive fines for this. Barring this, this is only going to get worse and worse as time goes on. A bigger concern for me, is that since all this software / hardware is being built in the purview of repressive regimes (the US government not withstanding), that government actors will employ or dictate methods by which they can tap that "telemetry" without a court order. It is important that the US pass these laws, as the majority of software that goes into these devices is built in the US (and, also, since the US is still the single largest market for them). If laws are passed in other countries, because of the cowboy mentality in the US (see: Uber, Facebook, Google, Microsoft in Europe, et al), I highly doubt there is any hope for self-regulation within the software industry itself, and that government intervention is necessary in this case.