12 ms·

The Internet of Onions

100 points by azdle 10y ago

azdle 10y ago
I work for a large IoT PaaS provider. Would this be valuable for customers on our platform if we supported something like this? I'm trying to think through all the problems with this and while I think the redesign of our platform will actually make this harder, there's no reason it wouldn't be possible. I also don't really understand how Tor works. Does this break anything like persistent connections or letting screw up anything with using UDP over longer time spans? (My other pet project is CoAP.) I don't actually work on the products team, but I bet I could fight for something like this. (Plus figuring this out would actually be fun rather than the tedium that my real job has become.)
- anonbanker 10y ago
  Please fight for this. the more providers supporting turnkey (or on-by-default) tor routing, the better IoT will end up being. If I can be a tad more hyperbolic, this is probably the most important thing a provider can do to ensure security of the devices within.
- dsr_ 10y ago
  Supporting Tor is a niche thing, but... it would be very very helpful if everything in the IoT could be persuaded to go through a customer-controlled local gateway, which could proxy, rate-limit, redirect, and firewall connections according to the owner's policy. Every device that reaches back to the mothership with a proprietary protocol is another device which gets discarded when the mothership loses interest in supporting it, and probably has major holes in it as well.
  - rogerbinns 10y ago
    What do you propose manufacturers do? (This is a serious question.) Customers aren't witholding money from products, so there isn't much in the way of economic incentives. Having and supporting open protocols is more work than internal only. Often times the mothership is using other products to provide the service which are proprietary and paid for, so nothing is free (as in beer) or free (as in speech). "Do more work for no additional revenue" is a very hard sell! I desperately want LAN SSL for a product I work on. It isn't simple, but there is a known approach (Plex do it) and it would be great for letsencrypt to solve. You can see my last plea from just over a month ago in HN comments: https://news.ycombinator.com/item?id=11956088 https://news.ycombinator.com/item?id=11956088
    - kbenson 10y ago
      > Customers aren't witholding money from products I think part of the problem here is that everything is so new, relatively speaking, that almost no company can actually trade on their reputation. If today a company was able to advertise on having sold internet connected devices for a decade and their earlier devices still worked well in some manner, then people might actually use that in their purchase criteria. Who can say that as of right now? Compare this to other industries. For cars, you have companies with varying levels of reputation (and that ebbs and flows over time). A big part of this is that car companies (and dealerships) aren't continually forcing you into using their related services. Oh, they'll encourage you and try to set up situations where it's strongly encouraged, but they know that many people will refuse to buy if they had no choice but to service their vehicle at the dealership they bought it from. What do you think would happen if Honda decided that for the next model year all fasteners were going to be non-standard sizes and with proprietary heads (think locking wheel nuts for for everything)? After the first few horror stories, Honda would deservedly start getting a reputation for being much harder to deal with, and lots of hidden costs. Right now we are moving towards a situation where all the IoT companies work like this, but they are all so new, and changing so often, that there's no benefit to a good reputation because there's no associated history to go with it. What we need are standards. Google and other major video platforms could help with part of this. Adopt a github type model for youtube or some service like it, where it works as it does now but if you want a private device-driven stream of video to be accepted, there's a standard for that and you can pay a small monthly fee (or it's free. The standard is the important part). Similarly, a standard for how to change settings for devices would be useful. HTML obviously works, but being so general may not be the best solution for what amounts to simple needs. A REST endpoint that supports a few well defined routes for discovery of routes and descriptions of them, as well as a route to return the entire configuration for backup, might work better, especially as it could easily be embedded in a larger dashboard for other devices (such as a "home" dashboard).
      - rogerbinns 10y ago
        Cars are also relatively expensive. iot products seem more in the disposable and non-essential space. You can always just throw it away without much inconvenience, so why put a lot of effort into the purchase process? Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). And cell phones are far more important than lights etc. As for the last paragraph, perhaps certification instead of standards? The equivalent of UL (Underwriters Laboratory) would work, but it would need to suit the nature, prices and timelines of these products. At least consumers would then know to look for the logo. While there could be conventions for REST endpoints, I'm sceptical they would be of any use. The devices by their nature are special purpose (rather than general) so there would be a lot more domain knowledge needed to make sense of them. Additionally making them robust against general clients versus only in-house ones is a lot more work. The general ones would attempt to do nonsensical or potentially even harmful settings, and so would require more engineering spend to protect against.
  - jerf 10y ago
    I'm not sure what you mean by "persuaded", since unless the IoT device has its own cellular connection, it can't prevent being passed through a consumer-controlled device. Do you have such a device right now that is being bypassed? Because if the answer is no, that's your real problem.
    - azdle 10y ago
      Sure, but with any device that's doing security correctly right now, the only thing you get to control is whether you let it connect to the service it wants to use or not. It's not like you can re-target it connection and choose which types of calls make it through and which don't. And at that point you might as well just choose to not plug it in to the network (or give it your wifi credentials or whatever).
    - TeMPOraL 10y ago
      The problem with IoT is that the 'I' expands to "Internet" instead of "Intranet". A device should not be rendered useless because it can't connect to manufacturer's servers. The cloud is a good value-add option, but should not be considered a primary and required element. The other thing is that most of those devices are gimmicks, toys - a good device intended to be useful should embrace interoperability - devices working alone have only a fraction the of potential of devices working together[0]. As for bypassing your device, at some point a "clever" entrepreneur will discover SSL and certificate pinning, and then you'll be SOL. [0] - that's why e.g. I recently shelled out and got myself Hues. It's not the cheapest option, but it's reliable, works perfectly well over LAN, has a decent API exposing pretty much all possible functionality and then some over said LAN, no cloud registration or other bullshit. Also I kind of trust Phillips not to burn my house down with crappy manufacturing.
  - conradev 10y ago
    I am imagining a world where a local gateway isn't even needed thanks to Tor's decentralized (and secure) ability to do NAT traversal. You could make your phone the hub. If IoT accessories connected directly to Tor, you could go through a pairing process once on your phone (via Bluetooth or whatnot), and access the device from anywhere in the world – no hub and no mothership required.
  - thaumasiotes 10y ago
    > but... it would be very very helpful if everything in the IoT could be persuaded to go through a customer-controlled local gateway, which could proxy, rate-limit, redirect, and firewall connections according to the owner's policy. They all already do? What IoT devices supply their own internet connection?
- s_q_b 10y ago
  Tor isn't designed for UDP. There are workarounds to tunnel UDP, but they're fragile and not suitable for production.
scaddison 10y ago
Off topic ish, am I supposed to be able to read this without a subscription?
- tux3 10y ago
  Yes! This is a subscriber link, which can be used to share articles with non-subscribers. My understanding is that as long as it's not systematically abused to avoid subscribing, sharing is encouraged.
- azdle 10y ago
  Yes, LWN has a feature that lets subscribers share a subscriber-only article with non-subscribers. I think there should be a message on the page along the lines of "A subscriber has made this available to you, would you like to subscribe?"
  - corbet 10y ago
    There is a message to that effect when non-subscribers read a sublinked article like this. Sometimes with a trial offer. The occasional (occasional!) posting of subscriber links is, I think, one of the best marketing tools we have.
    - dredmorbius 10y ago
      Jon, I've been looking into a lot of elements of information goods, and there are a few bits I'm coming to realise, slowly (it's only been 30 years I've been studying this). 1. Information is a public good. Nonrivalrous, only very difficultly excludable. Strong positive externalities. Hal Varian's got a good piece on this. Doesn't mean you cannot sell it, but it means that doing exclusively has serious negative effects. 2. Free-sample giveaways are almost always an excellent idea. John Dvorak's recent "Whatever Happened to Wordstar" had an excellent illustration of this: Worse, in 1985, the company produced Wordstar2000, a copy protected program that was nothing like the older lovable Wordstar and which contained annoying copy-protection features that scared most users away. While many pundits including Esther Dyson predicted great things for Wordstar2000, users rejected it. The product was big and slow and expensive. And despite complaints by the company and others, people wanted software they could copy and use on more than one machine. During this era piracy sold software and created market share. People would use a bootleg copy of Wordstar and eventually buy a copy. Wordstar may have been the most pirated software in the world, which in many ways accounted for its success. (Software companies don’t like to admit to this as a possibility.) Books for Wordstar sold like hot cakes and the authors knew they were selling documentation for pirated copies of Wordstar. The company itself should have just sold the documentation alone to increase sales. http://www.dvorak.org/blog/whatever-happened-to-wordstar-2/ http://www.dvorak.org/blog/whatever-happened-to-wordstar-2/ 3. Corporate and foundation grants and sponsorships or support may be an option. I've been following the Rockefeller Foundation's "100 and Change" program with some interest -- the application process is structured to also seek projects benefiting from other forms of support. http://www.nytimes.com/2016/06/03/us/macarthur-foundation-will-award-100-million-for-solution-to-a-global-problem.html http://www.nytimes.com/2016/06/03/us/macarthur-foundation-wi... Food for thought.
drazvan 10y ago
I'm actually working on something based on this idea - I've created a SIM card for the Internet of Things - basically a smartcard (microSD form factor) that offers a persistent crypto-secure identity for Internet-connected objects. It works by holding the TOR hidden service private key inside a tamper-resistant smartcard and generating/signing hidden service descriptors with it (plus an entire mechanism to prevent you from signing future descriptors - meaning that the identity is closely tied to the physical SIM card, just like in the GSM world - whoever has the SIM has the identity, once you've removed the SIM the identity goes with it). Discussion at https://lists.torproject.org/pipermail/tor-dev/2016-June/011134.html https://lists.torproject.org/pipermail/tor-dev/2016-June/011... - I've made progress since that post, it's now fully operational and tested, just need to figure out a way to turn it into a product and get some funding for it.
- ccallebs 10y ago
  I'm working on something that may be a complement to this. My email is in my profile if you want to chat.

100 points by azdle 10y ago

azdle 10y ago

I work for a large IoT PaaS provider. Would this be valuable for customers on our platform if we supported something like this? I'm trying to think through all the problems with this and while I think the redesign of our platform will actually make this harder, there's no reason it wouldn't be possible. I also don't really understand how Tor works. Does this break anything like persistent connections or letting screw up anything with using UDP over longer time spans? (My other pet project is CoAP.) I don't actually work on the products team, but I bet I could fight for something like this. (Plus figuring this out would actually be fun rather than the tedium that my real job has become.)

anonbanker 10y ago
Please fight for this. the more providers supporting turnkey (or on-by-default) tor routing, the better IoT will end up being. If I can be a tad more hyperbolic, this is probably the most important thing a provider can do to ensure security of the devices within.
dsr_ 10y ago
Supporting Tor is a niche thing, but... it would be very very helpful if everything in the IoT could be persuaded to go through a customer-controlled local gateway, which could proxy, rate-limit, redirect, and firewall connections according to the owner's policy. Every device that reaches back to the mothership with a proprietary protocol is another device which gets discarded when the mothership loses interest in supporting it, and probably has major holes in it as well.
- rogerbinns 10y ago
  What do you propose manufacturers do? (This is a serious question.) Customers aren't witholding money from products, so there isn't much in the way of economic incentives. Having and supporting open protocols is more work than internal only. Often times the mothership is using other products to provide the service which are proprietary and paid for, so nothing is free (as in beer) or free (as in speech). "Do more work for no additional revenue" is a very hard sell! I desperately want LAN SSL for a product I work on. It isn't simple, but there is a known approach (Plex do it) and it would be great for letsencrypt to solve. You can see my last plea from just over a month ago in HN comments: https://news.ycombinator.com/item?id=11956088 https://news.ycombinator.com/item?id=11956088
  - kbenson 10y ago
    > Customers aren't witholding money from products I think part of the problem here is that everything is so new, relatively speaking, that almost no company can actually trade on their reputation. If today a company was able to advertise on having sold internet connected devices for a decade and their earlier devices still worked well in some manner, then people might actually use that in their purchase criteria. Who can say that as of right now? Compare this to other industries. For cars, you have companies with varying levels of reputation (and that ebbs and flows over time). A big part of this is that car companies (and dealerships) aren't continually forcing you into using their related services. Oh, they'll encourage you and try to set up situations where it's strongly encouraged, but they know that many people will refuse to buy if they had no choice but to service their vehicle at the dealership they bought it from. What do you think would happen if Honda decided that for the next model year all fasteners were going to be non-standard sizes and with proprietary heads (think locking wheel nuts for for everything)? After the first few horror stories, Honda would deservedly start getting a reputation for being much harder to deal with, and lots of hidden costs. Right now we are moving towards a situation where all the IoT companies work like this, but they are all so new, and changing so often, that there's no benefit to a good reputation because there's no associated history to go with it. What we need are standards. Google and other major video platforms could help with part of this. Adopt a github type model for youtube or some service like it, where it works as it does now but if you want a private device-driven stream of video to be accepted, there's a standard for that and you can pay a small monthly fee (or it's free. The standard is the important part). Similarly, a standard for how to change settings for devices would be useful. HTML obviously works, but being so general may not be the best solution for what amounts to simple needs. A REST endpoint that supports a few well defined routes for discovery of routes and descriptions of them, as well as a route to return the entire configuration for backup, might work better, especially as it could easily be embedded in a larger dashboard for other devices (such as a "home" dashboard).
    - rogerbinns 10y ago
      Cars are also relatively expensive. iot products seem more in the disposable and non-essential space. You can always just throw it away without much inconvenience, so why put a lot of effort into the purchase process? Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). And cell phones are far more important than lights etc. As for the last paragraph, perhaps certification instead of standards? The equivalent of UL (Underwriters Laboratory) would work, but it would need to suit the nature, prices and timelines of these products. At least consumers would then know to look for the logo. While there could be conventions for REST endpoints, I'm sceptical they would be of any use. The devices by their nature are special purpose (rather than general) so there would be a lot more domain knowledge needed to make sense of them. Additionally making them robust against general clients versus only in-house ones is a lot more work. The general ones would attempt to do nonsensical or potentially even harmful settings, and so would require more engineering spend to protect against.
- jerf 10y ago
  I'm not sure what you mean by "persuaded", since unless the IoT device has its own cellular connection, it can't prevent being passed through a consumer-controlled device. Do you have such a device right now that is being bypassed? Because if the answer is no, that's your real problem.
  - azdle 10y ago
    Sure, but with any device that's doing security correctly right now, the only thing you get to control is whether you let it connect to the service it wants to use or not. It's not like you can re-target it connection and choose which types of calls make it through and which don't. And at that point you might as well just choose to not plug it in to the network (or give it your wifi credentials or whatever).
  - TeMPOraL 10y ago
    The problem with IoT is that the 'I' expands to "Internet" instead of "Intranet". A device should not be rendered useless because it can't connect to manufacturer's servers. The cloud is a good value-add option, but should not be considered a primary and required element. The other thing is that most of those devices are gimmicks, toys - a good device intended to be useful should embrace interoperability - devices working alone have only a fraction the of potential of devices working together[0]. As for bypassing your device, at some point a "clever" entrepreneur will discover SSL and certificate pinning, and then you'll be SOL. [0] - that's why e.g. I recently shelled out and got myself Hues. It's not the cheapest option, but it's reliable, works perfectly well over LAN, has a decent API exposing pretty much all possible functionality and then some over said LAN, no cloud registration or other bullshit. Also I kind of trust Phillips not to burn my house down with crappy manufacturing.
- conradev 10y ago
  I am imagining a world where a local gateway isn't even needed thanks to Tor's decentralized (and secure) ability to do NAT traversal. You could make your phone the hub. If IoT accessories connected directly to Tor, you could go through a pairing process once on your phone (via Bluetooth or whatnot), and access the device from anywhere in the world – no hub and no mothership required.
- thaumasiotes 10y ago
  > but... it would be very very helpful if everything in the IoT could be persuaded to go through a customer-controlled local gateway, which could proxy, rate-limit, redirect, and firewall connections according to the owner's policy. They all already do? What IoT devices supply their own internet connection?
s_q_b 10y ago
Tor isn't designed for UDP. There are workarounds to tunnel UDP, but they're fragile and not suitable for production.

scaddison 10y ago

Off topic ish, am I supposed to be able to read this without a subscription?

tux3 10y ago
Yes! This is a subscriber link, which can be used to share articles with non-subscribers. My understanding is that as long as it's not systematically abused to avoid subscribing, sharing is encouraged.
azdle 10y ago
Yes, LWN has a feature that lets subscribers share a subscriber-only article with non-subscribers. I think there should be a message on the page along the lines of "A subscriber has made this available to you, would you like to subscribe?"
- corbet 10y ago
  There is a message to that effect when non-subscribers read a sublinked article like this. Sometimes with a trial offer. The occasional (occasional!) posting of subscriber links is, I think, one of the best marketing tools we have.
  - dredmorbius 10y ago
    Jon, I've been looking into a lot of elements of information goods, and there are a few bits I'm coming to realise, slowly (it's only been 30 years I've been studying this). 1. Information is a public good. Nonrivalrous, only very difficultly excludable. Strong positive externalities. Hal Varian's got a good piece on this. Doesn't mean you cannot sell it, but it means that doing exclusively has serious negative effects. 2. Free-sample giveaways are almost always an excellent idea. John Dvorak's recent "Whatever Happened to Wordstar" had an excellent illustration of this: Worse, in 1985, the company produced Wordstar2000, a copy protected program that was nothing like the older lovable Wordstar and which contained annoying copy-protection features that scared most users away. While many pundits including Esther Dyson predicted great things for Wordstar2000, users rejected it. The product was big and slow and expensive. And despite complaints by the company and others, people wanted software they could copy and use on more than one machine. During this era piracy sold software and created market share. People would use a bootleg copy of Wordstar and eventually buy a copy. Wordstar may have been the most pirated software in the world, which in many ways accounted for its success. (Software companies don’t like to admit to this as a possibility.) Books for Wordstar sold like hot cakes and the authors knew they were selling documentation for pirated copies of Wordstar. The company itself should have just sold the documentation alone to increase sales. http://www.dvorak.org/blog/whatever-happened-to-wordstar-2/ http://www.dvorak.org/blog/whatever-happened-to-wordstar-2/ 3. Corporate and foundation grants and sponsorships or support may be an option. I've been following the Rockefeller Foundation's "100 and Change" program with some interest -- the application process is structured to also seek projects benefiting from other forms of support. http://www.nytimes.com/2016/06/03/us/macarthur-foundation-will-award-100-million-for-solution-to-a-global-problem.html http://www.nytimes.com/2016/06/03/us/macarthur-foundation-wi... Food for thought.

drazvan 10y ago

I'm actually working on something based on this idea - I've created a SIM card for the Internet of Things - basically a smartcard (microSD form factor) that offers a persistent crypto-secure identity for Internet-connected objects. It works by holding the TOR hidden service private key inside a tamper-resistant smartcard and generating/signing hidden service descriptors with it (plus an entire mechanism to prevent you from signing future descriptors - meaning that the identity is closely tied to the physical SIM card, just like in the GSM world - whoever has the SIM has the identity, once you've removed the SIM the identity goes with it). Discussion at https://lists.torproject.org/pipermail/tor-dev/2016-June/011134.html https://lists.torproject.org/pipermail/tor-dev/2016-June/011... - I've made progress since that post, it's now fully operational and tested, just need to figure out a way to turn it into a product and get some funding for it.

ccallebs 10y ago
I'm working on something that may be a complement to this. My email is in my profile if you want to chat.