> like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected

> like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures... Hopefully either a consumer or business alliance crops up with suggested practices for IoT devices, including remediation methods for these very scenarios. Part of the difficulty here is precisely that when it comes to IoT, there is no such thing as "expected security procedures", in no small part because established best practices on the internet often simply don't transfer well to a set of devices where a great many are expected to be acting as servers positioned behind very aggressive consumer firewalls. Even the "ideal case" applying the web security model to these kinds of devices leaves you with a very difficult NAT problem, and a very difficult authentication problem. You're left, more or less, with two mainstream approaches: either find a way to open up consumer firewalls (or bypass them entirely, for example by setting up your own dedicated access point for the device) and then issue the devices with its own TLS cert, OR use a centralized trusted-third-party auth model. Both, in addition to presenting enormous scaling problems, are shitty "solutions" when you're talking about devices with extremely high reliability requirements, like thermostats. If you have to connect to a TTP auth service for your heat to turn on, and your internet goes down, and it's winter in Canada... So there are countless examples and anecdotes as to why it's not really as simple as establishing new best practices; entire new technologies may need to be established here. Now on the one hand, privacy and security are always secondary markets, so I don't think we'll see any direct calls for change through their advocates. On the other hand, these problems aren't just a matter of privacy and security: if you've ever tried to put together a consumer-grade solution for something like IoT, you know how hard it is -- largely as a result of the same technological shortfalls that are compromising security. As a business, anything that can save you development time/costs is going to be tremendously appreciated. So there's a nascent market gap for a technology that 1.) makes development companies happy by decreasing time/cost to market, and 2.) gives/forces security on them, in such a way that 1.) is inseparable from 2.). And that, I think, is really the way forward for privacy and security in IoT. That's what I'm hoping, anyways, because I've sorta started a company trying to do that. The rest of this is basically a plug, so feel free to ignore it, but our product is called Hypergolix[1] and we're planning on releasing a very early preview alpha in the next few weeks. Our value prop for developers is that we're "Dropbox for Python objects, with an emphasis on IoT and privacy/security", and everything is enforced directly by cryptography. This also lets us do some really cool things like failover-to-LAN if your internet drops out, completely transparently to applications built on top of it. [1] https://www.hypergolix.com https://www.hypergolix.com