5 ms·

It's not that easy. I stick with brands/products that are reviewed by people I trust or have seemed to pick up some momentum. My general rule of thumb is I NEV

It's not that easy. I stick with brands/products that are reviewed by people I trust or have seemed to pick up some momentum. My general rule of thumb is I NEVER buy anything IoT that is WiFi based. Zigbee or Z-Wave based devices will save you a lot of security nightmares (though definitely not all).

pavel_lishin 10y ago
Why is Z* preferable to Wifi-based?
- gnur 10y ago
  One of the reasons would be that it isn't used that often and won't allow access to your network with commodity hardware.
  - EarthIsHome 10y ago
    Isn't this idea hiding the problem though? While using uncommon hardware and protocols may thwart certain users, it's really not solving the problem of security. It's somewhat similar to the idea of using a hidden wireless network and calling that security instead of securing your network with WPA2, etc. As these devices become more popular, we'll start seeing more Zigbees and Z-wave devices become commodity hardware.
    - Dayshine 10y ago
      Not at all, anyone can "join" the network, but nobody can decrypt the traffic without the key. Zigbee has built-in, easy, encryption. You simply set your router to allow unsecured joins temporarily whenever you get a new device, which then learns the key. When the network is set to allow only secure joins only devices pre-configured with the key can see anything other than encrypted frames.
  - garduque 10y ago
    I've installed tens (if not hundreds) of thousands of Zigbee devices over the last handful of years. Zigbee may be uncommon in residential, but it is not uncommon.
    - steve-howard 10y ago
      Compared with wifi, though? Trying to screw with your wifi equipment requires just about any laptop sold in the last ten years. Trying to screw with your Zigbee equipment would presumably require me to go find some kind of dongle. Of course, wifi has gotten more secure over time to the point that I'd be more concerned about giving the devices internet access than I would about intruders on the network.
      - garduque 10y ago
        Sure, in the world there are probably more wifi devices, and I'll agree that wifi adapters are as mainstream as it gets. But just because the hardware to mess with Zigbee stuff isn't consumer mainstream doesn't mean the devices don't exist and aren't "used that much," as the comment OP incorrectly claimed. In just one highrise project I did in Las Vegas last year we installed something like 65,000 Zigbee devices, and that's not atypical for highrise hotel construction. Zigbee is everywhere in building automation.
- georgehotelling 10y ago
  Say you wanted to build a protocol for IoT stuff. What would be on your feature list? Low power: it should not require much in the way of network traffic or heartbeats so that you could leave the radio mostly off. Mesh networking: ideally the devices should be able to repeat commands so that they could be low-power and not have to broadcast across entire houses. Secure: it should have specific ways to join a network that don't require a keyboard on the device. IoT application focused: the protocol should make it easy to do things like turn a device on/off, set a value or read a value. Z-Wave and Zigbee do these things (for the most part), while WiFi is sort of hacked to try to maybe accomplish it. For instance, my Z-wave thermostat has been running off the same lithium AA batteries for about a year now, and the battery level is at 77%. I can't imagine a WiFi device being able to achieve that.
- dreamcompiler 10y ago
  Z* can't set up an SSH tunnel to a server in China just because it wants to.
ocdtrekkie 10y ago
Insteon isn't bad either. Though it's proprietary, which is a big downside. But without you setting up a Hub or software on your PC, the hardware has no way of talking to the Internet. (And most of Insteon works without a Hub or PC even!)
pjc50 10y ago
It doesn't bridge directly to real IP, there will be a 'hub' somewhere. You can't talk directly to the devices from any PC or mobile on the network, which is less convenient but reduces the attack surface to just the hub. (It's also much more power-efficient; you can't really use wifi on battery powered devices unless you charge them frequently)
- kordless 10y ago
  I've gotten an ESP8266 device to last for about 3 days with (2) AAs when in using sleep mode aggressively for the wifi. Not to say that the Python stack is stable on it. It's not.
  - dmoy 10y ago
    Right, exactly. 3 days vs potentially year~ for a low power chip with an RF transmitter.
unwiredben 10y ago
If it's not connected to the Internet, isn't that just a Network of Things?
- cosmeen 10y ago
  You mean Intranet of Things.

pavel_lishin 10y ago

Why is Z* preferable to Wifi-based?

gnur 10y ago
One of the reasons would be that it isn't used that often and won't allow access to your network with commodity hardware.
- EarthIsHome 10y ago
  Isn't this idea hiding the problem though? While using uncommon hardware and protocols may thwart certain users, it's really not solving the problem of security. It's somewhat similar to the idea of using a hidden wireless network and calling that security instead of securing your network with WPA2, etc. As these devices become more popular, we'll start seeing more Zigbees and Z-wave devices become commodity hardware.
  - Dayshine 10y ago
    Not at all, anyone can "join" the network, but nobody can decrypt the traffic without the key. Zigbee has built-in, easy, encryption. You simply set your router to allow unsecured joins temporarily whenever you get a new device, which then learns the key. When the network is set to allow only secure joins only devices pre-configured with the key can see anything other than encrypted frames.
- garduque 10y ago
  I've installed tens (if not hundreds) of thousands of Zigbee devices over the last handful of years. Zigbee may be uncommon in residential, but it is not uncommon.
  - steve-howard 10y ago
    Compared with wifi, though? Trying to screw with your wifi equipment requires just about any laptop sold in the last ten years. Trying to screw with your Zigbee equipment would presumably require me to go find some kind of dongle. Of course, wifi has gotten more secure over time to the point that I'd be more concerned about giving the devices internet access than I would about intruders on the network.
    - garduque 10y ago
      Sure, in the world there are probably more wifi devices, and I'll agree that wifi adapters are as mainstream as it gets. But just because the hardware to mess with Zigbee stuff isn't consumer mainstream doesn't mean the devices don't exist and aren't "used that much," as the comment OP incorrectly claimed. In just one highrise project I did in Las Vegas last year we installed something like 65,000 Zigbee devices, and that's not atypical for highrise hotel construction. Zigbee is everywhere in building automation.
georgehotelling 10y ago
Say you wanted to build a protocol for IoT stuff. What would be on your feature list? Low power: it should not require much in the way of network traffic or heartbeats so that you could leave the radio mostly off. Mesh networking: ideally the devices should be able to repeat commands so that they could be low-power and not have to broadcast across entire houses. Secure: it should have specific ways to join a network that don't require a keyboard on the device. IoT application focused: the protocol should make it easy to do things like turn a device on/off, set a value or read a value. Z-Wave and Zigbee do these things (for the most part), while WiFi is sort of hacked to try to maybe accomplish it. For instance, my Z-wave thermostat has been running off the same lithium AA batteries for about a year now, and the battery level is at 77%. I can't imagine a WiFi device being able to achieve that.
dreamcompiler 10y ago
Z* can't set up an SSH tunnel to a server in China just because it wants to.

ocdtrekkie 10y ago

Insteon isn't bad either. Though it's proprietary, which is a big downside. But without you setting up a Hub or software on your PC, the hardware has no way of talking to the Internet. (And most of Insteon works without a Hub or PC even!)

pjc50 10y ago

It doesn't bridge directly to real IP, there will be a 'hub' somewhere. You can't talk directly to the devices from any PC or mobile on the network, which is less convenient but reduces the attack surface to just the hub. (It's also much more power-efficient; you can't really use wifi on battery powered devices unless you charge them frequently)

kordless 10y ago
I've gotten an ESP8266 device to last for about 3 days with (2) AAs when in using sleep mode aggressively for the wifi. Not to say that the Python stack is stable on it. It's not.
- dmoy 10y ago
  Right, exactly. 3 days vs potentially year~ for a low power chip with an RF transmitter.

unwiredben 10y ago

If it's not connected to the Internet, isn't that just a Network of Things?

cosmeen 10y ago
You mean Intranet of Things.