4 ms·

Would you feel comfortable with end-to-end encryption via an open, documented, free protocol? This is literally my raison d'être as a company, so I'd be interes

by nbadg 10y ago

Would you feel comfortable with end-to-end encryption via an open, documented, free protocol? This is literally my raison d'être as a company, so I'd be interested to hear your comfort level. What I've got is a platform that 1.) makes it substantially easier for IoT developers to get their devices to market and 2.} enforces end-to-end encryption and affirmative consensual sharing. It works by running as a background service on both the IoT device and on any connecting computers. In a similar vein to IPFS, the service magically switches between local and nonlocal networks dynamically, so it doesn't matter if your interent connection goes out; as long as you have power (and a local server set up, but I'd like to add P2P capability over LAN in the near future) you're good to go. I realize this isn't the whole device you want, but is that a starting point you'd be interested in?

CaptSpify 10y ago
That absolutely sounds like a good starting point. Any more info?
- nbadg 10y ago
  Definitely. First a disclaimer: I've held off on creating a dedicated post for this until the code is stable (as in not crashing) enough for other people to play with the demo. That will hopefully happen tomorrow, or possibly Friday. At that point I'll be posting here on HN as well as several subreddits. Until then, I'd request it not be posted on social media, so I can maximize the impact of the potential exposure. + Golix is the name of the protocol: https://github.com/Muterra/doc-golix https://github.com/Muterra/doc-golix + Hypergolix is the background service I've written to implement it, which is backed by a PaaS on AWS: https://www.hypergolix.com https://www.hypergolix.com + This is a demo of Hypergolix: https://github.com/Muterra/py_hypergolix_demos/tree/master/echo-101 https://github.com/Muterra/py_hypergolix_demos/tree/master/e... Cheers, and thanks for the feedback!
deleted 10y ago
[deleted]
DougN7 10y ago
I've been debating about hooking my garage door opener up using a built-in feature so I could open the door from my iPhone. I don't trust that whatever central site I'll be connected to is safe. If I _knew_ the vendor had implemented your protocol/software well, and I _knew_ your software was safe, yeah, I'd use it. But I don't know those two things, so no way am I hooking my home's door up to the Internet...
- wcummings 10y ago
  Still probably more secure than most remote garage door openers tbh
- nbadg 10y ago
  In my case you actually do know that the vendor is using the protocol. You would have to be running the protocol on (in this example) your iPhone in order to talk to it. Everything is client-side verified and enforced by encryption. You wouldn't have any guarantee that the garage door opener isn't also running a separate web connection in the background, but arguably unless you're actively monitoring your LAN (or just plain radio) traffic you don't have that anyways. Put a different way, you can't prevent your manufacturer from, for example, adding a SIM card and wireless connection to your garage door opener. At some point you have to trust them.
  - DougN7 10y ago
    When you say I'd have to be running the protocol, wouldn't I really be running their garage door opener app? In other words, how do I know your protocol is being used?
    - nbadg 10y ago
      If they were using the protocol, they have two options: 1. Roll their own implementation (highly discouraged). Increase their development burden. Introduce higher maintenance burden. Slightly more flexibility for app deployment. And run the risk of my company disallowing interoperable embedded commercial implementations out of security concerns for the users. Basically, at this point the company is better off not using the protocol. 2. Use our implementation (Hypergolix). Massively decrease development and maintenance burden. They now have an install dependency, though, so distribution is a bit more complicated. Significant reduction in time and money invested in the app. The critical point is this: with option 1, you're correct in that you don't know the protocol is in use, but it's extremely likely that they wouldn't be using it here, nor advertise that they were. With option two, you know that they are using it, because you have to manually install the application to run the protocol.

by nbadg 10y ago

CaptSpify 10y ago

That absolutely sounds like a good starting point. Any more info?

nbadg 10y ago
Definitely. First a disclaimer: I've held off on creating a dedicated post for this until the code is stable (as in not crashing) enough for other people to play with the demo. That will hopefully happen tomorrow, or possibly Friday. At that point I'll be posting here on HN as well as several subreddits. Until then, I'd request it not be posted on social media, so I can maximize the impact of the potential exposure. + Golix is the name of the protocol: https://github.com/Muterra/doc-golix https://github.com/Muterra/doc-golix + Hypergolix is the background service I've written to implement it, which is backed by a PaaS on AWS: https://www.hypergolix.com https://www.hypergolix.com + This is a demo of Hypergolix: https://github.com/Muterra/py_hypergolix_demos/tree/master/echo-101 https://github.com/Muterra/py_hypergolix_demos/tree/master/e... Cheers, and thanks for the feedback!

deleted 10y ago

[deleted]

DougN7 10y ago

I've been debating about hooking my garage door opener up using a built-in feature so I could open the door from my iPhone. I don't trust that whatever central site I'll be connected to is safe. If I _knew_ the vendor had implemented your protocol/software well, and I _knew_ your software was safe, yeah, I'd use it. But I don't know those two things, so no way am I hooking my home's door up to the Internet...

wcummings 10y ago
Still probably more secure than most remote garage door openers tbh
nbadg 10y ago
In my case you actually do know that the vendor is using the protocol. You would have to be running the protocol on (in this example) your iPhone in order to talk to it. Everything is client-side verified and enforced by encryption. You wouldn't have any guarantee that the garage door opener isn't also running a separate web connection in the background, but arguably unless you're actively monitoring your LAN (or just plain radio) traffic you don't have that anyways. Put a different way, you can't prevent your manufacturer from, for example, adding a SIM card and wireless connection to your garage door opener. At some point you have to trust them.
- DougN7 10y ago
  When you say I'd have to be running the protocol, wouldn't I really be running their garage door opener app? In other words, how do I know your protocol is being used?
  - nbadg 10y ago
    If they were using the protocol, they have two options: 1. Roll their own implementation (highly discouraged). Increase their development burden. Introduce higher maintenance burden. Slightly more flexibility for app deployment. And run the risk of my company disallowing interoperable embedded commercial implementations out of security concerns for the users. Basically, at this point the company is better off not using the protocol. 2. Use our implementation (Hypergolix). Massively decrease development and maintenance burden. They now have an install dependency, though, so distribution is a bit more complicated. Significant reduction in time and money invested in the app. The critical point is this: with option 1, you're correct in that you don't know the protocol is in use, but it's extremely likely that they wouldn't be using it here, nor advertise that they were. With option two, you know that they are using it, because you have to manually install the application to run the protocol.