8 ms·

Sadly, all of the IoT-devices I have read about so far are either deeply creepy (like that Barbie doll that records and transmits children's conversations to th

by krylon 11y ago

Sadly, all of the IoT-devices I have read about so far are either deeply creepy (like that Barbie doll that records and transmits children's conversations to the mothership) or completely useless (like a razor that automatically orders new blades). And given the mediocre job we have done with online security so far, one can easily think of half a dozen scenarios for the "IoT" (the term alone makes me cringe) to turn in to security nightmare. Think of the Windows malware wave of 2003, when you could not install XP on an internet-connected machine without catching some worm before the installation was finished; now think of billions of lightbulbs, fridges, thermostats and whatnot and how much thought their designers must have put into security. Unless we wise up soon, the future is going to become very "interesting". EDIT: I just remembered one useful device - a networked smoke detector that the fire department remotely query to see e.g. what parts of a building a fire has spread to and that can tell a central computer when its battery runs out. I could imagine this being really, really useful often enough that it's worth it. But still, the security concern remains. (IIRC, the smoke detectors were not connected to the internet and did not use regular Wifi, which would make sense - if my living room is on fire, my internet connection and wifi router probably aren't so much working as ... liquified.)

api 11y ago
All the deeply creepy ones derive their creepiness from cloud tethering-- they transmit everything back to the mothership and can only be used via the mothership. You are putting a microphone, camera, etc. in your house that someone else has absolute real-time control over, and then because it's a "thing" you are going to forget it is there. Yet every single IoT kit, howto, stack-as-a-service, or other piece of material or IoT startup I see enshrines this as The Way. IoT devices connect to IoT cloud backends and that's how it's done. Period. There are several reasons: (1) Vendors desperately want to avoid total commoditization. Competition in the hardware space comes from cheap Chinese vendors with unbelievably cheap labor and monstrous economies of scale. Tethering your device to a backend provides both some amount of lock-in and keeps your secret sauce away from the Chinese reverse engineers. (Or so people think.) This is as true for Chinese vendors as it is for domestic ones-- don't expect them to forgo this strategy when their competition is each other. (2) There is no good solution for end-to-end transit that copes with the ugliness of endpoint networks. Full disclosure: I am founder of a company that is trying to address #2 in an open, scalable, reliable, and interoperable way. I am therefore partial to this problem. Yet I also think it may be the easier of the two to solve since it's mostly just a technical problem. Problem #1 is deeply baked into the structure of the market and I have no idea how to solve it. Pathological emergent behaviors like this in complex systems like markets are notoriously hard to fix. You can see the train wreck but you as an individual are helpless against it-- in fact you are almost forced to help drive the train off the cliff because every market incentive points that way. Usually the ham-fisted solution of legislation is the only thing that can address such pathologies in the real world. I hate that as a still-semi-libertarian but it is what it is. Edit: It gets worse. Now add: (3) All kinds of creepy agents from governments to crooks to (perhaps worst of all) quasi-crooked "dark pattern" companies who want to "monetize the user," would love to get as many Internet-connected cameras, microphones, sensors, etc. into your house as they can. It's a gold mine of private data they can do creepy things with. Think about the malware situation on PCs -- that is about to happen to your house. #1 and #3 obviously interact constructively. The race-to-the-bottom nature of hardware and the ease with which software is copied means that companies must look for any revenue stream they can. We've seen what this has done to the web: the most successful web companies are free services that monetize the user through surveillance. It's hard to imagine that the same economics won't drive IoT vendors to the same endpoint. Edit #2: I toy around with the deeply contrarian idea that what we need are significantly stronger intellectual property laws to upend this economic death spiral, but I am not at all convinced that that is the answer or that it would have any chance of working. The other less radical idea is that this is a marketing problem, and that IoT is ripe for a higher-end vendor to come in and say "we aren't creepy." Would customers pay twice as much for a genuinely useful or enjoyable IoT device that came with an iron clad privacy policy, open APIs, and direct connectivity so you could avoid any cloud dependency? The conventional wisdom that I hear endlessly repeated is "customers don't care about privacy or security." I see evidence of this myself -- e.g. not a single user out of many thousand has asked us (ZeroTier) about the quality of our crypto. "It's end to end encrypted!" With what? A software implementation of a cereal box cipher? Nobody cares. Yet I wonder: just how creepy do you have to get before people start caring? Do people care when Barbie is listening to their children? When their Amazon Echo is submitting the sound of them having sex to Amazon? How pitifully abusive and downright gross does our relationship with "the cloud" have to get before people actually start caring whether their doors are locked? Okay enough rant -- back to work trying to put a dent in this problem in a way that's probably more effective than posting to HN. #1 might be the harder of the two problems but if #2 isn't solved there is no chance of #1 being addressed.
- neutronicus 11y ago
  > just how creepy do you have to get before people start caring? It has to be in some way that isn't automated. If a tree falls in the forest, and a surveillance system integrates it with the sound of millions of trees falling in forests all over the country in order to build and monetize a detailed model of trees falling in forests, but no one actually listens to it ... did it make a sound?
  - api 11y ago
    Got it. So it's going to take a pedophile site appearing on a darknet that contains thousands of hours of captured home camera footage of naked kids, or a well documented case of an activist or journalist being singled out for a high-resolution IRS audit based on their home political speech.
    - neutronicus 11y ago
      More pedophile, less activist (who gives a shit about activists...).
    - mratzloff 11y ago
      Someone wanting to force US legislative action on this might be so inclined to create a site that live streams video from cameras across the country, searchable by city.
      - fixermark 11y ago
        I mean, that already exists; it's called Shodan, and it lets you search the webcam output of cams that have their security improperly configured and are dumping data in the open. The engine: https://www.shodan.io/ https://www.shodan.io/ The Ars Technica story: http://arstechnica.com/security/2016/01/how-to-search-the-internet-of-things-for-photos-of-sleeping-babies/ http://arstechnica.com/security/2016/01/how-to-search-the-in... ... and still the public does not care.
        11y ago
deleted 11y ago
[deleted]

by krylon 11y ago

api 11y ago

All the deeply creepy ones derive their creepiness from cloud tethering-- they transmit everything back to the mothership and can only be used via the mothership. You are putting a microphone, camera, etc. in your house that someone else has absolute real-time control over, and then because it's a "thing" you are going to forget it is there. Yet every single IoT kit, howto, stack-as-a-service, or other piece of material or IoT startup I see enshrines this as The Way. IoT devices connect to IoT cloud backends and that's how it's done. Period. There are several reasons: (1) Vendors desperately want to avoid total commoditization. Competition in the hardware space comes from cheap Chinese vendors with unbelievably cheap labor and monstrous economies of scale. Tethering your device to a backend provides both some amount of lock-in and keeps your secret sauce away from the Chinese reverse engineers. (Or so people think.) This is as true for Chinese vendors as it is for domestic ones-- don't expect them to forgo this strategy when their competition is each other. (2) There is no good solution for end-to-end transit that copes with the ugliness of endpoint networks. Full disclosure: I am founder of a company that is trying to address #2 in an open, scalable, reliable, and interoperable way. I am therefore partial to this problem. Yet I also think it may be the easier of the two to solve since it's mostly just a technical problem. Problem #1 is deeply baked into the structure of the market and I have no idea how to solve it. Pathological emergent behaviors like this in complex systems like markets are notoriously hard to fix. You can see the train wreck but you as an individual are helpless against it-- in fact you are almost forced to help drive the train off the cliff because every market incentive points that way. Usually the ham-fisted solution of legislation is the only thing that can address such pathologies in the real world. I hate that as a still-semi-libertarian but it is what it is. Edit: It gets worse. Now add: (3) All kinds of creepy agents from governments to crooks to (perhaps worst of all) quasi-crooked "dark pattern" companies who want to "monetize the user," would love to get as many Internet-connected cameras, microphones, sensors, etc. into your house as they can. It's a gold mine of private data they can do creepy things with. Think about the malware situation on PCs -- that is about to happen to your house. #1 and #3 obviously interact constructively. The race-to-the-bottom nature of hardware and the ease with which software is copied means that companies must look for any revenue stream they can. We've seen what this has done to the web: the most successful web companies are free services that monetize the user through surveillance. It's hard to imagine that the same economics won't drive IoT vendors to the same endpoint. Edit #2: I toy around with the deeply contrarian idea that what we need are significantly stronger intellectual property laws to upend this economic death spiral, but I am not at all convinced that that is the answer or that it would have any chance of working. The other less radical idea is that this is a marketing problem, and that IoT is ripe for a higher-end vendor to come in and say "we aren't creepy." Would customers pay twice as much for a genuinely useful or enjoyable IoT device that came with an iron clad privacy policy, open APIs, and direct connectivity so you could avoid any cloud dependency? The conventional wisdom that I hear endlessly repeated is "customers don't care about privacy or security." I see evidence of this myself -- e.g. not a single user out of many thousand has asked us (ZeroTier) about the quality of our crypto. "It's end to end encrypted!" With what? A software implementation of a cereal box cipher? Nobody cares. Yet I wonder: just how creepy do you have to get before people start caring? Do people care when Barbie is listening to their children? When their Amazon Echo is submitting the sound of them having sex to Amazon? How pitifully abusive and downright gross does our relationship with "the cloud" have to get before people actually start caring whether their doors are locked? Okay enough rant -- back to work trying to put a dent in this problem in a way that's probably more effective than posting to HN. #1 might be the harder of the two problems but if #2 isn't solved there is no chance of #1 being addressed.

neutronicus 11y ago
> just how creepy do you have to get before people start caring? It has to be in some way that isn't automated. If a tree falls in the forest, and a surveillance system integrates it with the sound of millions of trees falling in forests all over the country in order to build and monetize a detailed model of trees falling in forests, but no one actually listens to it ... did it make a sound?
- api 11y ago
  Got it. So it's going to take a pedophile site appearing on a darknet that contains thousands of hours of captured home camera footage of naked kids, or a well documented case of an activist or journalist being singled out for a high-resolution IRS audit based on their home political speech.
  - neutronicus 11y ago
    More pedophile, less activist (who gives a shit about activists...).
  - mratzloff 11y ago
    Someone wanting to force US legislative action on this might be so inclined to create a site that live streams video from cameras across the country, searchable by city.
    - fixermark 11y ago
      I mean, that already exists; it's called Shodan, and it lets you search the webcam output of cams that have their security improperly configured and are dumping data in the open. The engine: https://www.shodan.io/ https://www.shodan.io/ The Ars Technica story: http://arstechnica.com/security/2016/01/how-to-search-the-internet-of-things-for-photos-of-sleeping-babies/ http://arstechnica.com/security/2016/01/how-to-search-the-in... ... and still the public does not care.
      - 11y ago

deleted 11y ago

[deleted]