4 ms·

IoT devices can be fine, but there are lots of companies involved in it that don't know what they're doing and would be better off staying out of the market. I

by Feneric 10y ago

IoT devices can be fine, but there are lots of companies involved in it that don't know what they're doing and would be better off staying out of the market. I always advice friends / family to look for upgrading capabilities, ability to do useful work when not connected to the Internet proper, user control (do you own this device or effectively borrow it per licensing etc.?), and other similar things before purchasing any IoT device. Some IoT devices are great, but some are abysmal.

Klathmon 10y ago
And it sounds like this one was like 80% of the way there. I mean they used encryption (badly, but they still used it), had a way to update the software on the device (even if only over http), and uses passwords (although doesn't enforce them).
- pjc50 10y ago
  So everything it does, it does badly? To me, that's not 80% of the way there, that's more like -80%.
  - Klathmon 10y ago
    Come on, the last thing he reviewed sent everything in plaintext, had no root password, called out to multiple chinese servers, ran ssh via a hardcoded password that was something like a simple word, and didn't have any way of actually updating the code on the device. Oh, and it barely even functioned as a lightbulb... This is lightyears better than that, and yeah they fucked up a bunch of stuff, but it at least shows they tried. Even shitty AES is going to increase security over plaintext...
    - snoman 10y ago
      Agreed. It may not be technically good, but it's as good as the door locks that hundreds of millions of people rely on to protect their homes every day. Most home doors/deadbolts are easily pickable with a few weeks' practice. It keeps honest people honest.
      - Klathmon 10y ago
        I somewhat agree. Since it's only a plug, if the worst that a hacker can do is turn your plug on and off, it's not the end of the world. But if there is a vulnerability that lets someone use this plug to pivot an attack on the rest of your machines in your network, now it's a big fuckin deal.
_pmf_ 10y ago
"Cheap mass market product of mostly unknown provenience" and "in my WiFi network" are simply two things that do not fit well together.

by Feneric 10y ago

Klathmon 10y ago

And it sounds like this one was like 80% of the way there. I mean they used encryption (badly, but they still used it), had a way to update the software on the device (even if only over http), and uses passwords (although doesn't enforce them).

pjc50 10y ago
So everything it does, it does badly? To me, that's not 80% of the way there, that's more like -80%.
- Klathmon 10y ago
  Come on, the last thing he reviewed sent everything in plaintext, had no root password, called out to multiple chinese servers, ran ssh via a hardcoded password that was something like a simple word, and didn't have any way of actually updating the code on the device. Oh, and it barely even functioned as a lightbulb... This is lightyears better than that, and yeah they fucked up a bunch of stuff, but it at least shows they tried. Even shitty AES is going to increase security over plaintext...
  - snoman 10y ago
    Agreed. It may not be technically good, but it's as good as the door locks that hundreds of millions of people rely on to protect their homes every day. Most home doors/deadbolts are easily pickable with a few weeks' practice. It keeps honest people honest.
    - Klathmon 10y ago
      I somewhat agree. Since it's only a plug, if the worst that a hacker can do is turn your plug on and off, it's not the end of the world. But if there is a vulnerability that lets someone use this plug to pivot an attack on the rest of your machines in your network, now it's a big fuckin deal.

_pmf_ 10y ago

"Cheap mass market product of mostly unknown provenience" and "in my WiFi network" are simply two things that do not fit well together.