5 ms·

I don't mind Internet-connected home devices, as long as they: a) are actually secure b) do not send any data to the vendor or any third-party services

carterehsmith 10y ago
I would love it, but it looks like it will take time. As for security, we've been building PCs and such for decades and still are just beginning to get it right. Looks like one really needs a TPM chip as in Chromebook or iPhone. That may be too expensive for many devices, hell, it is apparently too expensive for most desktops, laptops etc. As for sending data. Seems like an IOT vendor would hope to sell the usage data. That does seem to have some value.
- bigiain 10y ago
  Raspberry Pi's SOC has had ARM TrustZone support right from the beginning (I'm pretty sure, definitely in recent models). I don't know if we can rely on crypto secure unique keys having been burned at some stage inside every Pi (Not sure if that'd be done by Broadcom or 'Pi?), but the "too expensive" argument seems unsound... (I fully expect to read soon about some Chinese manufactured IoT device where every single one if millions manufactured has an identical MAC, GUID, and TrustZone private key...) http://hackerboards.com/trustzone-tee-tech-ported-to-raspberry-pi-3/ http://hackerboards.com/trustzone-tee-tech-ported-to-raspber...
  - carterehsmith 10y ago
    IIRC ARM TrustZone is not a TMP chip, just some software. And the other day we read that people managed to break it, possibly affecting many Android devices.
fapjacks 10y ago
No idea why you're being downvoted. This is absolutely valid commentary. Most IoT home devices are atrocious from both a security and a privacy perspective. There are fairly regular posts on HN about the shit-awful security of these devices. Just yesterday there was the post about the guy with the bad Amazon review. Also, there's another problem I see with this crap, and I can see right where it's going to end up... It won't be long before the FBI gets some judge to declare that our homes are no longer private because our thermostats are connected to the internet. I am already infuriated at the things law enforcement claims in court. I can sense a migraine on the horizon when it comes to a home connected to the internet.
superuser2 10y ago
>b) do not send any data to the vendor or any third-party services Then why would they be connected to the internet? Are you imagining people will set up DynDNS and port forwarding through their wireless routers to connect to their smart devices directly, or what?
- enraged_camel 10y ago
  >>Then why would they be connected to the internet? I like the idea of being able to remote control them. For example, it would be cool if I could securely tell my coffee machine to start making coffee when I leave work at 3pm on Friday so that it's ready by the time I get home.
  - superuser2 10y ago
    How would you remote control it without going through someone else's server? I understand that an HN reader could set up DynDNS, a DHCP reservation, and port forwarding (so you could connect directly to your home from the internet), but that would not seem to make for a viable consumer product.

carterehsmith 10y ago

I would love it, but it looks like it will take time. As for security, we've been building PCs and such for decades and still are just beginning to get it right. Looks like one really needs a TPM chip as in Chromebook or iPhone. That may be too expensive for many devices, hell, it is apparently too expensive for most desktops, laptops etc. As for sending data. Seems like an IOT vendor would hope to sell the usage data. That does seem to have some value.

bigiain 10y ago
Raspberry Pi's SOC has had ARM TrustZone support right from the beginning (I'm pretty sure, definitely in recent models). I don't know if we can rely on crypto secure unique keys having been burned at some stage inside every Pi (Not sure if that'd be done by Broadcom or 'Pi?), but the "too expensive" argument seems unsound... (I fully expect to read soon about some Chinese manufactured IoT device where every single one if millions manufactured has an identical MAC, GUID, and TrustZone private key...) http://hackerboards.com/trustzone-tee-tech-ported-to-raspberry-pi-3/ http://hackerboards.com/trustzone-tee-tech-ported-to-raspber...
- carterehsmith 10y ago
  IIRC ARM TrustZone is not a TMP chip, just some software. And the other day we read that people managed to break it, possibly affecting many Android devices.

fapjacks 10y ago

No idea why you're being downvoted. This is absolutely valid commentary. Most IoT home devices are atrocious from both a security and a privacy perspective. There are fairly regular posts on HN about the shit-awful security of these devices. Just yesterday there was the post about the guy with the bad Amazon review. Also, there's another problem I see with this crap, and I can see right where it's going to end up... It won't be long before the FBI gets some judge to declare that our homes are no longer private because our thermostats are connected to the internet. I am already infuriated at the things law enforcement claims in court. I can sense a migraine on the horizon when it comes to a home connected to the internet.

superuser2 10y ago

>b) do not send any data to the vendor or any third-party services Then why would they be connected to the internet? Are you imagining people will set up DynDNS and port forwarding through their wireless routers to connect to their smart devices directly, or what?

enraged_camel 10y ago
>>Then why would they be connected to the internet? I like the idea of being able to remote control them. For example, it would be cool if I could securely tell my coffee machine to start making coffee when I leave work at 3pm on Friday so that it's ready by the time I get home.
- superuser2 10y ago
  How would you remote control it without going through someone else's server? I understand that an HN reader could set up DynDNS, a DHCP reservation, and port forwarding (so you could connect directly to your home from the internet), but that would not seem to make for a viable consumer product.