12 ms·

IoT’s killer app is not home security

101 points by gvb 10y ago

nbadg 10y ago
I think the article does a decent job of highlighting some of (what I hear as) the primary concerns surrounding IoT, namely: 1. WiFi needs to always work 2. Internet connection needs to always work 3. Power needs to always work 4. Stability of software and firmware 5. Trustworthiness of software and firmware (including data leakage, privacy, etc) Simultaneously, though it rightly points out that IoT is still very much in its infancy, I think it misses a very important observation: there will absolutely come a day when IoT is unavoidable. Not as in you can't avoid encountering it, but as in you can't avoid owning it. There will, (I think anyways) without a doubt, be a day when devices that the average Western consumer considers necessary for everyday life -- things like refrigerators, electric meters, thermostats, and so on -- are effectively impossible to buy "dumb". Every analysis and meta-analysis of IoT that I've seen has been incredibly bullish on it, and I think that's an indication of how much economic incentive there is for it. Given that, I'd say automobile ECIs are the proof in the pudding for the assertion that IoT will be unavoidably ubiquitous. As an experiment, try to find a new car that you can personally can actually buy, that doesn't have a computer in it. As the median Western consumer, that's not possible. So I'm pretty convinced that for IoT, non-participation will not remain an option. So then the question is, what do we do about those 5 issues? I tend to look at stuff like this from an economic perspective; clearly device producers haven't seen enough market pressure to give a shit about any of them. Right now, the only pressure device creators are demonstrating is a profound push to get something, anything, to market. It really is an internet of shit. That being said, even the bare minimum is really hard here. You're talking about a system architecture that our existing infrastructure simply isn't cut out to handle. Think about the challenges involved in deploying a reliable authentication system to a web-scale application, and now imagine doing it in a way that can't necessarily rely upon a central server. It's far easier to just "punt" on the second half of that, assume the traditional web paradigm (trusted third party server), and call it a day. And make no mistake, for a commercial device, authentication is absolutely required, even for home WiFi network: not everyone wants every person in their house to control, for example, their locks. Or, alternatively, imagine an AirBNB host being forced to give their guests unfettered access to their IoT vibrator (yes, they exist). These edge cases are everywhere, and they make authentication of some sort or another an absolute requirement. My hope is that someone (and by someone, in all honesty I'm talking about my own project [1]) can come along and say to device producers: 1. I understand how hard it is for you to make any IoT device. 2. I'm going to make it substantially cheaper for you to do that, but... 3. The privacy and security I've baked into my system is inseparable from your economic benefit as a device producer. The idea is to evolve that into: 4. You cannot be competitive in the IoT marketplace without privacy and security. At this point, with how completely and totally horrendous the industry has been in these areas so far, I think that's the only viable way we can achieve those goals without a tremendous amount of growing pains. [1] The project is called Hypergolix, and at this point it's basically "Dropbox for Python objects, geared towards IoT, with an emphasis on social, and secured via end-to-end encryption". We're in the process of getting a private alpha shippable, to be followed soon by a public alpha. It all works, and it's all open source, but there's some necessary stuff we need to iron out in the coming weeks. Our outdated landing page is https://hypergolix.com https://hypergolix.com, but a better preview of the developer experience is on our very incomplete docs page: http://pyhgx.readthedocs.io/en/latest/index.html http://pyhgx.readthedocs.io/en/latest/index.html . The whole project is backed by a crypto protocol known as Golix: https://github.com/Muterra/doc-golix https://github.com/Muterra/doc-golix
- deleted 10y ago
  [deleted]
- nbadg 10y ago
  To expound a little on this combination: > There will... be a day when devices [are] necessary for everyday life... are effectively impossible to buy "dumb". > As an experiment, try to find a new car that you can personally can actually buy, that doesn't have a computer in it. The reason I'm convinced this is the case is simply economics. Solid-state electronic controls are very often simpler, cheaper, and more reliable than mechanical ones. When it comes to, for example, thermostat in your refrigerator, on your hot water heater, etc, the reason the economics have, thus far, worked out in favor of the mechanical controls it that the external costs associated with solid state electronics -- the software development, the upkeep, the initial electrical design, etc -- have been too high to justify them (in many cases). But as those external costs decrease, which they (through maturation of the IoT field) inevitably will, the solid-state electronics will be increasingly economically competitive, until eventually to have competitive margins as a device manufacturer, you have to go the connected route. When I say "impossible to buy dumb", I'm not suggesting that every refrigerator is going to have a Google calendar on it or something, I'm talking about all of the little things you take for granted. Don't underestimate the banality of automation. Cars are a particularly apt example because the exact same thing happened to the automotive industry with the advent of the ECU. The added technical complexity of their computer control was initially only economically justifiable in performance vehicles. As time went on, and ECUs progressed and matured, they became cheaper and cheaper, until even the cheapest new cars were forced to incorporate them to be competitive in the market.
unabst 10y ago
IoT will explode when 1) open hardware gains unprecedented trust between the user and their hardware, 2) users begin to prefer open source software because that's just how the most secure and user-first software is maintained, and 3) TBD open hosting. 1 + 2 = "my bulb is an open spec made by factory X running on transparent software maintained by people who care" 3 = "and I host it myself on Y" 3 is the missing link, and it's yesterday's self-hosting that hasn't made it to it's next incarnation. When we'd self-host our web site, we owned the box, owned the set-up and felt absolutely in control of the system. It may not have been as reliable or fast as a hosting service, but there is comfort in full ownership and full control. To their own detriment the shared hosting industry went to shit when they settled for their shady marketing eco-system (paid reviews, not unlimited unlimited quotas, cheap bad service). No one trusts shared hosting now, and so Squarespace and the like have gained popularity, but that's a fully corporate owned opaque service. The closest to 3 we have now is AWS and Google Cloud and the like, but they are not made for normal users. Dropbox would have been a good candidate but they lose credibility with every word they speak (damage control clearly centered on themselves, ignoring customer complaints). 3 could be 1) a new self-hosting local box that has it's own app or something that's fully contained and in your house. 2) A cloud provider that has managed to detach their corporate interests from their shared infrastructure (like amazon and google have towards developers). Consumers don't want their IoT console cluttered with ads or "recommended items for you" and the last thing consumers want is for Google to mine their personal IoT information. Or 3) a standardized open source cloud platform where users can take their data from one provider to another while enjoying full ownership (local backups), privacy (full encryption), and portability (zero lock-down).
- acidburnNSA 10y ago
  3 is the open-source http://home-assistant.io http://home-assistant.io engine hosted on a local Raspberry Pi and accessed remotely through a DD-WRT OpenVPN. It's here now, and it's amazing.
  - unabst 10y ago
    Exactly. When this (and the like) goes mainstream, and I can buy standard-based hardware, IoT will explode. Consumers do not trust corporations, and will not let them in their home. (This might sound counter intuitive because corporations are all over our homes, but consumers don't want that, and IoT is extremely personal -- it's the home.)
cbuq 10y ago
I agree that the security of IOT devices is petty terrible in its current state. However the author seems to make a mistake in generalizing that "It doesn’t take a professional to realize his particular house of cards [home security system] is about as fragile as they come." The average person does not understand the danger of IOT, and this is where the most damage will come from.
- flogic 10y ago
  Physical security doesn't have the same parameters as digital security though. The pool of attackers on the internet is much larger and more sophisticated than those looking to break into the average person's home. To put it in more concrete terms. The door to my home has 2 deadbolt locks. I would be highly surprised to learn that either can't be picked in a short period of time by someone with enough skill. That said the probability of that happening to my door is relatively low. The same level of exploitability in a web browser though is much more likely to be a problem. In short the pools of likely attackers for my home is quite different from the pool of attackers for my digital presence. The primary concern I have with IoT is it's potential to expand the pool of attackers for my home.
- rhizome 10y ago
  To be sure, it depends on the concept being communicated to the average person at all. Average people understand epidemics and by extension the Morris Worm-like danger expanded IoT (in its current state) brings.
zrgiu_ 10y ago
IoT finding its footing in augmenting other systems rather than revolutionizing them This is key. All the companies that are trying to start from scratch and build something big are failing or are hitting huge roadblocks due to high learning curves. On the other hand, those that are starting with simple, one-feature, even buttonless devices (philips hue, chromecast, echo) are the ones that are staying afloat. I'm in this niche, and have been hit hard by this reality. IoT is definitely coming, but right now it is SO young, immature and fragmented, that it takes a pretty skilled person to use it in any meaningful way. People need to be educated, and the best (read: only) way to do that is to introduce them to IoT one piece at a time. And these pieces have to be reliable and consistent. Until then, the switch on the wall has nothing to worry about.
- lgleason 10y ago
  The problem with IOT is that it's the tower of babble. Interoperability will be the killer feature that will drive growth.
jaredraby 10y ago
This was interesting look at home IoT is used in home security today and it's current downfalls. However, the items that seem IoT specific are ones that are issues in implementation, not application. To frame what I mean when I say "IoT specific", I'm pointing out that many of the examples that he highlights are also the downfall of traditional security systems as well. If you have remote monitoring, and you internet/telephone line goes down, IoT or not, you've lost the service end of discussion. It doesn’t take a professional to realize his particular house of cards is about as fragile as they come. It is built on the assumption that one’s WiFi will always work, their internet connection will always be up, power will always be on, and every piece of software and firmware is stable and trustworthy." Power loss on traditional security, wifi loss on traditional security, hard wire cut on traditional security, all of these will take their toll as well, not just on an IoT system. Onto the IoT specific related items. The implementation issues that he highlights; having to have your app open to record footage. Your cellphone being at the bottom of you bag and you can't reach it. These are all problems that can happen already. If you can't reach your phone when the security company calls you to notify of a break in, this is the same problem. I understand why there is a lot of distaste for IoT, and all the security pitfalls that happen. However this is not an inherent issue to the concept, rather is a breakdown of implementation of security protocols that are not being followed and a lack of learning from traditional systems that isn't being applied. After thinking about this for a while there are ways to bolster an IoT security or monitoring system: > Power / connection required for signaling. So rather than waiting for a system to signal something is wrong, wait for a heartbeat to die. > Battery back up: Pretty obvious. You should have a way to at least keep your systems for a period while you get power restored > Multiple links to a central service. WiFi and Cellular, monitor for connections going down and built in trouble shooting to notify the user if there is one or the other > Centralized data center for always on recording, pay an additional $10/mo for the ability to store your data elsewhere or offer local 24 hour recordings in the security base station in your home like many dash cams have now. As for security concerns I look at it this way. Remote connections are something we've got down pat, assuming everyone follows it. Blaming IoT on being inherently insecure is like blaming the database password leaks on mysql rather than an open port and plain text user name / passwords. I think IoT security has a place and purpose that offers benefits over a traditional system, we're just waiting for the right implementation.
sverige 10y ago
Adding more insecure devices to protect your home makes no sense. Whatever happened to the idea that fewer "moving parts" meant less likelihood of failure? The selling point is that you can monitor all this stuff remotely on your phone, but really, what can you do about it? I don't see how this surpasses the (very expensive) services like Brink's and ADT who will contact law enforcement for you. And yes, I've seen the ad where the guy is at the store trying to figure out what to buy and can look in his fridge from his phone. Whatever happened to making a grocery list before you leave?
- JshWright 10y ago
  While I think the camera in the fridge thing is of dubious value, "whatever happened to X" is not an especially strong argument against something...
  - Klathmon 10y ago
    Honestly I think the camera in the fridge is a great idea. Who hasn't forgotten to check if they have something? Who hasn't been near the market by chance and decided to pickup something and didn't do a full list before hand? It is something that can be useful, adds a pretty small amount of cost to an appliance like that, and doesn't get in the way of someone that doesn't want to use the feature. It's a fantastic IoT opportunity, because if it breaks or doesn't work, the fridge still works fine without it.
    - dorfsmay 10y ago
      And beside, we'll finally be able to establish if the light in the fridge is on or off when the door is closed!
- alexbanks 10y ago
  To play devil's advocate, what ever happened to making a mix tape from songs on the radio to play in your large battery powered Walkman on the go? "Why can't we just do it the old way" isn't the best argument for halting attempts at innovation. Before we can have the IoT we see in movies, we have to have gradual iterative progress in the way we think of/use the tech.
PieterH 10y ago
It's always porn and games.
eveningcoffee 10y ago
I most of the cases there is no need for I part. What most people actually need is local in house system. They do not need leaches that suck on their data and they do not need products that stop to work in few years because company producing them and providing a "service" looses the interest.
Animats 10y ago
Most of the "smart" door locks suck as locks.[1] Most are physically too weak. Most need regular battery replacement, although a few generate power from turning the handle. If you want any real door security, you have to go to steel doors and frames, and multipoint locks. You can get door/frame/lock systems which look normal and operate like a regular door, but bolts go out the top, bottom, and sides into the frame, like a vault door. [1] http://schuylertowne.com/blog/smart-locks http://schuylertowne.com/blog/smart-locks
- kbenson 10y ago
  As an addition to your point, it's always worth noting there is no such thing as perfect security (at least not in any useful way). As soon as you make your door much more hardened, there are other points of entry that will be used instead. It does you little good to transform your door into a foot thick slab of concrete if your window is still just a couple panes of glass, or someone can just take a sledgehammer to your wall next to the door and it's just a few sheets of plywood and some 2x4's. Passive security measures buy you time, which in turn makes you a less lucrative target by requiring more effort and making it more likely someone will notice and intervention will arrive before the intruder has completed their goal. This applies equally as well to network security, and usually this comes up here because of analogies in discussions regarding network security, but it applies just the same no matter which direction you approach it from. What this means in context is that it's often better to step back and look at what your real goal is. It's entirely possible a sign stating "guard dog on premises" (whether you have one or not) will prevent a lot more break-ins than a better padlock. On the other hand, if the convenience is what you are after, then you have a different set of criteria to consider.
  - AceJohnny2 10y ago
    > As soon as you make your door much more hardened, there are other points of entry that will be used instead. It does you little good to transform your door into a foot thick slab of concrete if your window is still just a couple panes of glass, or someone can just take a sledgehammer to your wall next to the door and it's just a few sheets of plywood and some 2x4's. Well sure, but like in all security it's about adjusting the attacker's effort/reward ratio. As I recall [citation needed], most burglaries are less than a few minutes, in-and-out affairs. Make it harder than that, and you can deter the low-effort attackers.
bsder 10y ago
While his thesis for things that are related to home security in the face of an adversary are correct, there are a lot more cases that aren't so dire. Gee, someone is banging on my door at 3AM in the morning. I'd really like to see who it is WITHOUT being directly behind the door. Especially since it's most likely to be a neighbor or the police and greeting them with a shotgun is not likely to result in a positive outcome. A cam on my door that I can see from my phone would be kinda useful. My water heater, washer, shower, etc. just broke. I'd really like to get continuous alerts on my phone that there is water filling up my house. There are lots of things like this. They're grubby and mucky and an opportunity, but they are not high volume and they require more than 3 guys and a dog and some software.
- acidburnNSA 10y ago
  To further your point, I live in a high-crime urban area in an apartment complex that gets broken into weekly by folks stealing packages and prowling cars. My apartment used to have no security, and it would have stayed there if I hadn't gotten into the open source Python 3 home automation engine https://home-assistant.io https://home-assistant.io. I got it up on a Raspberry Pi and fiddled with it for lots of things. Now, if my door opens or motion is detected and the alarm is armed: * My stereo gets turned on by an IR LED * A scary mp3 I threw together with dogs barking, sirens blaring, and monsters growling starts playing loudly * My camera starts taking snapshots and saving them locally and emailing them to me * All the lights in my apt. start blinking on and off If I'm home, this will wake me up if my door gets compromised, and possibly scare off the perp. If I'm not home I will almost certainly get the alert (services are up 99% of the time), and I feel relatively confident that it will scare off a low-level property thief. If professionals show up with SDR to jam my sensors, yeah they'll get in...I agree. But IoT home security is still good because some security is better than none, and there's no way I would have any security at all without it.
  - grogenaut 10y ago
    What software defined radio would screw up your sensors? The ones you listed above are all door or ir. Or did you just mean the motion sensors?
fpgaminer 10y ago
I recently looked at the landscape of smart door locks, and came to the same conclusion as @Animats did in his comment. Actually, I would rephrase it to say _all_ smart door locks suck. All I really want right now is an RFID/NFC deadbolt, purely for convenience. Seems simple enough, and yet nothing secure exists. So I'm now set on trying to build my own lock. I'm thinking of just getting a really nice, mechanical deadbolt, and then building something similar in design to Lockitron, where it just sits on top of the deadbolt, augmenting it with digital authentication. For the keycards I plan to combine a low power MCU with NFC and Ed25519 cryptography for authentication. I found a variation of the MSP430 chips with built-in NFC capability which are designed to run battery-less (they harvest energy from the NFC signal). My rough calculations suggest that they'll be able to soak up enough power to do an Ed25519 signature in 0.25 seconds; fast enough for me. I'll just have the lock send a random challenge to the keycard, it responds with a signature of the challenge, and then the lock can verify the signature and confirm that the card is legit. It should be simple enough to mold the MSP430 and supporting electronics into a thin 1" diameter disc which I can hook to my keychain or put in my wallet. Awesome! The lock itself is just another MCU with NFC capabilities, battery, and motor. That setup satisfies my desire for a convenient, digital lock, while maintaining real security (Ed25519 with real random challenges, versus existing RFID solutions which use 48-bit keys, 3DES, suffer replay attacks, etc). I'm surprised these things don't already exist. I only had to spend an hour to find the MSP430 chip variation and sketch out this system...
- jschwartzi 10y ago
  How secure is the mechanism to tapping or smashing? Does it fail open, or closed?
  - fpgaminer 10y ago
    The whole unit is just a motor that actuates an existing deadbolt's thumbturn on the opposite side of the door (i.e. not accessible from the outside world). So failing open/closed is a question for the existing deadbolt, not this device.
- amluto 10y ago
niftich 10y ago
The commercial excitement over IoT is all about offering 'services' you couldn't offer before. When your house is full of these devices, some people will pay extra for the 'enhanced tier' of service (even if the basic tier is offered for free). In cases where the business model isn't subscription-based, it's either made up by the high retail price of the device, or indirectly monetizing the data collected for 'market research' and the like. IoT isn't about people hooking up jailbroken Kindles to one-way mirrors to show the weather. It's not about Ardunios and Raspberry Pis being used to collect some data, move some servos, and make a blog post about it. It's about big money to be made by introducing new monetization channels in places there were none before.
- euske 10y ago
  I've been saying that there are three "scammy" markets which tend to have a higher ratio of overpriced, scammy products, and they're the following: * Health * Education * Office productivity And now, * Home security (New!) The reason that I think these markets tend to be scammy is because their quality is mostly based on perception. And there's no easy way to drastically improve these, people tend to look for a magic pill. And you're right, security is certainly going to be one of them.
  - paavokoya 10y ago
    I'd add banking/financial services to that list..
    - ionised 10y ago
      The greatest of all cons.
  - nightcracker 10y ago
    The first two bullet points on your list are very specific to an american perspective. As a dutchman I do not consider these scammy markets whatsoever.
    - 10y ago
jimjimjim 10y ago
my guess is that companies are pushing this (rather than customer pull) because: 1) product differentiation, more vague tick boxes on the product comparison chart that your competitors don't have. 2) vendor lockin/ecosystem lockin. If the devices are not going straight to a remote server you'll need a "hub". your brandA lightbulbs will only talk to a brandA house hub which is incompatible with brandB security locks. 3) product churn. (did you really really need to replace your ok tv with one that does 3d? lots of people did). 4) clip the ticket. build a platform that involves transactions and take a cut. 5) data. paraphrasing: if you aren't paying for it, you aren't the customer you're the product. none of these really sound like a utopia for the average person.
- sjellis 10y ago
  There's also the "Star Trek factor" (I just made us this term). Tech people grow up watching or reading science fiction and then try to build the stuff for real, because it would be cool. We'll have to see if ordinary people find it useful.
yalogin 10y ago
IoT reminds me of the fiber optics craze of the late 90s. No one knew what the killer application for fiber was back then but every company was in it. Eerily similar to whats going on now with IoT.
kordless 10y ago
IoT isn't anything other than what already was. It's decentralized compute, plain and simple.
SigmundA 10y ago
I have had a HAI Omni Pro in my house for nearly a decade, it is a UL listed Fire/Burglary and automation system. It has never faulted or rebooted except when I needed to change its backup battery. There are Omni's running that where made in the 80's. It has a Ethernet port and a documented TCP protocol that uses 256 AES. I have an iOS app that talks to it directly, which means no lag in controlling it. Beyond Security and Fire, it controls my lights, HVAC, garage doors, sprinklers. It is one of the most reliable computing systems I have used. The recent IoT stuff is a joke compared to my Omni, unfortunately I think HAI got left behind and ended up selling out to Leviton and there seems to be little progress since then.
tempodox 10y ago
Laws and regulations may remedy the racket that IoT is now. I'll believe it when I see it.

101 points by gvb 10y ago

nbadg 10y ago

I think the article does a decent job of highlighting some of (what I hear as) the primary concerns surrounding IoT, namely: 1. WiFi needs to always work 2. Internet connection needs to always work 3. Power needs to always work 4. Stability of software and firmware 5. Trustworthiness of software and firmware (including data leakage, privacy, etc) Simultaneously, though it rightly points out that IoT is still very much in its infancy, I think it misses a very important observation: there will absolutely come a day when IoT is unavoidable. Not as in you can't avoid encountering it, but as in you can't avoid owning it. There will, (I think anyways) without a doubt, be a day when devices that the average Western consumer considers necessary for everyday life -- things like refrigerators, electric meters, thermostats, and so on -- are effectively impossible to buy "dumb". Every analysis and meta-analysis of IoT that I've seen has been incredibly bullish on it, and I think that's an indication of how much economic incentive there is for it. Given that, I'd say automobile ECIs are the proof in the pudding for the assertion that IoT will be unavoidably ubiquitous. As an experiment, try to find a new car that you can personally can actually buy, that doesn't have a computer in it. As the median Western consumer, that's not possible. So I'm pretty convinced that for IoT, non-participation will not remain an option. So then the question is, what do we do about those 5 issues? I tend to look at stuff like this from an economic perspective; clearly device producers haven't seen enough market pressure to give a shit about any of them. Right now, the only pressure device creators are demonstrating is a profound push to get something, anything, to market. It really is an internet of shit. That being said, even the bare minimum is really hard here. You're talking about a system architecture that our existing infrastructure simply isn't cut out to handle. Think about the challenges involved in deploying a reliable authentication system to a web-scale application, and now imagine doing it in a way that can't necessarily rely upon a central server. It's far easier to just "punt" on the second half of that, assume the traditional web paradigm (trusted third party server), and call it a day. And make no mistake, for a commercial device, authentication is absolutely required, even for home WiFi network: not everyone wants every person in their house to control, for example, their locks. Or, alternatively, imagine an AirBNB host being forced to give their guests unfettered access to their IoT vibrator (yes, they exist). These edge cases are everywhere, and they make authentication of some sort or another an absolute requirement. My hope is that someone (and by someone, in all honesty I'm talking about my own project [1]) can come along and say to device producers: 1. I understand how hard it is for you to make any IoT device. 2. I'm going to make it substantially cheaper for you to do that, but... 3. The privacy and security I've baked into my system is inseparable from your economic benefit as a device producer. The idea is to evolve that into: 4. You cannot be competitive in the IoT marketplace without privacy and security. At this point, with how completely and totally horrendous the industry has been in these areas so far, I think that's the only viable way we can achieve those goals without a tremendous amount of growing pains. [1] The project is called Hypergolix, and at this point it's basically "Dropbox for Python objects, geared towards IoT, with an emphasis on social, and secured via end-to-end encryption". We're in the process of getting a private alpha shippable, to be followed soon by a public alpha. It all works, and it's all open source, but there's some necessary stuff we need to iron out in the coming weeks. Our outdated landing page is https://hypergolix.com https://hypergolix.com, but a better preview of the developer experience is on our very incomplete docs page: http://pyhgx.readthedocs.io/en/latest/index.html http://pyhgx.readthedocs.io/en/latest/index.html . The whole project is backed by a crypto protocol known as Golix: https://github.com/Muterra/doc-golix https://github.com/Muterra/doc-golix

deleted 10y ago
[deleted]
nbadg 10y ago
To expound a little on this combination: > There will... be a day when devices [are] necessary for everyday life... are effectively impossible to buy "dumb". > As an experiment, try to find a new car that you can personally can actually buy, that doesn't have a computer in it. The reason I'm convinced this is the case is simply economics. Solid-state electronic controls are very often simpler, cheaper, and more reliable than mechanical ones. When it comes to, for example, thermostat in your refrigerator, on your hot water heater, etc, the reason the economics have, thus far, worked out in favor of the mechanical controls it that the external costs associated with solid state electronics -- the software development, the upkeep, the initial electrical design, etc -- have been too high to justify them (in many cases). But as those external costs decrease, which they (through maturation of the IoT field) inevitably will, the solid-state electronics will be increasingly economically competitive, until eventually to have competitive margins as a device manufacturer, you have to go the connected route. When I say "impossible to buy dumb", I'm not suggesting that every refrigerator is going to have a Google calendar on it or something, I'm talking about all of the little things you take for granted. Don't underestimate the banality of automation. Cars are a particularly apt example because the exact same thing happened to the automotive industry with the advent of the ECU. The added technical complexity of their computer control was initially only economically justifiable in performance vehicles. As time went on, and ECUs progressed and matured, they became cheaper and cheaper, until even the cheapest new cars were forced to incorporate them to be competitive in the market.

unabst 10y ago

IoT will explode when 1) open hardware gains unprecedented trust between the user and their hardware, 2) users begin to prefer open source software because that's just how the most secure and user-first software is maintained, and 3) TBD open hosting. 1 + 2 = "my bulb is an open spec made by factory X running on transparent software maintained by people who care" 3 = "and I host it myself on Y" 3 is the missing link, and it's yesterday's self-hosting that hasn't made it to it's next incarnation. When we'd self-host our web site, we owned the box, owned the set-up and felt absolutely in control of the system. It may not have been as reliable or fast as a hosting service, but there is comfort in full ownership and full control. To their own detriment the shared hosting industry went to shit when they settled for their shady marketing eco-system (paid reviews, not unlimited unlimited quotas, cheap bad service). No one trusts shared hosting now, and so Squarespace and the like have gained popularity, but that's a fully corporate owned opaque service. The closest to 3 we have now is AWS and Google Cloud and the like, but they are not made for normal users. Dropbox would have been a good candidate but they lose credibility with every word they speak (damage control clearly centered on themselves, ignoring customer complaints). 3 could be 1) a new self-hosting local box that has it's own app or something that's fully contained and in your house. 2) A cloud provider that has managed to detach their corporate interests from their shared infrastructure (like amazon and google have towards developers). Consumers don't want their IoT console cluttered with ads or "recommended items for you" and the last thing consumers want is for Google to mine their personal IoT information. Or 3) a standardized open source cloud platform where users can take their data from one provider to another while enjoying full ownership (local backups), privacy (full encryption), and portability (zero lock-down).

acidburnNSA 10y ago
3 is the open-source http://home-assistant.io http://home-assistant.io engine hosted on a local Raspberry Pi and accessed remotely through a DD-WRT OpenVPN. It's here now, and it's amazing.
- unabst 10y ago
  Exactly. When this (and the like) goes mainstream, and I can buy standard-based hardware, IoT will explode. Consumers do not trust corporations, and will not let them in their home. (This might sound counter intuitive because corporations are all over our homes, but consumers don't want that, and IoT is extremely personal -- it's the home.)

cbuq 10y ago

I agree that the security of IOT devices is petty terrible in its current state. However the author seems to make a mistake in generalizing that "It doesn’t take a professional to realize his particular house of cards [home security system] is about as fragile as they come." The average person does not understand the danger of IOT, and this is where the most damage will come from.

flogic 10y ago
Physical security doesn't have the same parameters as digital security though. The pool of attackers on the internet is much larger and more sophisticated than those looking to break into the average person's home. To put it in more concrete terms. The door to my home has 2 deadbolt locks. I would be highly surprised to learn that either can't be picked in a short period of time by someone with enough skill. That said the probability of that happening to my door is relatively low. The same level of exploitability in a web browser though is much more likely to be a problem. In short the pools of likely attackers for my home is quite different from the pool of attackers for my digital presence. The primary concern I have with IoT is it's potential to expand the pool of attackers for my home.
rhizome 10y ago
To be sure, it depends on the concept being communicated to the average person at all. Average people understand epidemics and by extension the Morris Worm-like danger expanded IoT (in its current state) brings.

zrgiu_ 10y ago

IoT finding its footing in augmenting other systems rather than revolutionizing them This is key. All the companies that are trying to start from scratch and build something big are failing or are hitting huge roadblocks due to high learning curves. On the other hand, those that are starting with simple, one-feature, even buttonless devices (philips hue, chromecast, echo) are the ones that are staying afloat. I'm in this niche, and have been hit hard by this reality. IoT is definitely coming, but right now it is SO young, immature and fragmented, that it takes a pretty skilled person to use it in any meaningful way. People need to be educated, and the best (read: only) way to do that is to introduce them to IoT one piece at a time. And these pieces have to be reliable and consistent. Until then, the switch on the wall has nothing to worry about.

lgleason 10y ago
The problem with IOT is that it's the tower of babble. Interoperability will be the killer feature that will drive growth.

jaredraby 10y ago

This was interesting look at home IoT is used in home security today and it's current downfalls. However, the items that seem IoT specific are ones that are issues in implementation, not application. To frame what I mean when I say "IoT specific", I'm pointing out that many of the examples that he highlights are also the downfall of traditional security systems as well. If you have remote monitoring, and you internet/telephone line goes down, IoT or not, you've lost the service end of discussion. It doesn’t take a professional to realize his particular house of cards is about as fragile as they come. It is built on the assumption that one’s WiFi will always work, their internet connection will always be up, power will always be on, and every piece of software and firmware is stable and trustworthy." Power loss on traditional security, wifi loss on traditional security, hard wire cut on traditional security, all of these will take their toll as well, not just on an IoT system. Onto the IoT specific related items. The implementation issues that he highlights; having to have your app open to record footage. Your cellphone being at the bottom of you bag and you can't reach it. These are all problems that can happen already. If you can't reach your phone when the security company calls you to notify of a break in, this is the same problem. I understand why there is a lot of distaste for IoT, and all the security pitfalls that happen. However this is not an inherent issue to the concept, rather is a breakdown of implementation of security protocols that are not being followed and a lack of learning from traditional systems that isn't being applied. After thinking about this for a while there are ways to bolster an IoT security or monitoring system: > Power / connection required for signaling. So rather than waiting for a system to signal something is wrong, wait for a heartbeat to die. > Battery back up: Pretty obvious. You should have a way to at least keep your systems for a period while you get power restored > Multiple links to a central service. WiFi and Cellular, monitor for connections going down and built in trouble shooting to notify the user if there is one or the other > Centralized data center for always on recording, pay an additional $10/mo for the ability to store your data elsewhere or offer local 24 hour recordings in the security base station in your home like many dash cams have now. As for security concerns I look at it this way. Remote connections are something we've got down pat, assuming everyone follows it. Blaming IoT on being inherently insecure is like blaming the database password leaks on mysql rather than an open port and plain text user name / passwords. I think IoT security has a place and purpose that offers benefits over a traditional system, we're just waiting for the right implementation.

sverige 10y ago

Adding more insecure devices to protect your home makes no sense. Whatever happened to the idea that fewer "moving parts" meant less likelihood of failure? The selling point is that you can monitor all this stuff remotely on your phone, but really, what can you do about it? I don't see how this surpasses the (very expensive) services like Brink's and ADT who will contact law enforcement for you. And yes, I've seen the ad where the guy is at the store trying to figure out what to buy and can look in his fridge from his phone. Whatever happened to making a grocery list before you leave?

JshWright 10y ago
While I think the camera in the fridge thing is of dubious value, "whatever happened to X" is not an especially strong argument against something...
- Klathmon 10y ago
  Honestly I think the camera in the fridge is a great idea. Who hasn't forgotten to check if they have something? Who hasn't been near the market by chance and decided to pickup something and didn't do a full list before hand? It is something that can be useful, adds a pretty small amount of cost to an appliance like that, and doesn't get in the way of someone that doesn't want to use the feature. It's a fantastic IoT opportunity, because if it breaks or doesn't work, the fridge still works fine without it.
  - dorfsmay 10y ago
    And beside, we'll finally be able to establish if the light in the fridge is on or off when the door is closed!
alexbanks 10y ago
To play devil's advocate, what ever happened to making a mix tape from songs on the radio to play in your large battery powered Walkman on the go? "Why can't we just do it the old way" isn't the best argument for halting attempts at innovation. Before we can have the IoT we see in movies, we have to have gradual iterative progress in the way we think of/use the tech.

PieterH 10y ago

It's always porn and games.

eveningcoffee 10y ago

I most of the cases there is no need for I part. What most people actually need is local in house system. They do not need leaches that suck on their data and they do not need products that stop to work in few years because company producing them and providing a "service" looses the interest.

Animats 10y ago

Most of the "smart" door locks suck as locks.[1] Most are physically too weak. Most need regular battery replacement, although a few generate power from turning the handle. If you want any real door security, you have to go to steel doors and frames, and multipoint locks. You can get door/frame/lock systems which look normal and operate like a regular door, but bolts go out the top, bottom, and sides into the frame, like a vault door. [1] http://schuylertowne.com/blog/smart-locks http://schuylertowne.com/blog/smart-locks

kbenson 10y ago
As an addition to your point, it's always worth noting there is no such thing as perfect security (at least not in any useful way). As soon as you make your door much more hardened, there are other points of entry that will be used instead. It does you little good to transform your door into a foot thick slab of concrete if your window is still just a couple panes of glass, or someone can just take a sledgehammer to your wall next to the door and it's just a few sheets of plywood and some 2x4's. Passive security measures buy you time, which in turn makes you a less lucrative target by requiring more effort and making it more likely someone will notice and intervention will arrive before the intruder has completed their goal. This applies equally as well to network security, and usually this comes up here because of analogies in discussions regarding network security, but it applies just the same no matter which direction you approach it from. What this means in context is that it's often better to step back and look at what your real goal is. It's entirely possible a sign stating "guard dog on premises" (whether you have one or not) will prevent a lot more break-ins than a better padlock. On the other hand, if the convenience is what you are after, then you have a different set of criteria to consider.
- AceJohnny2 10y ago
  > As soon as you make your door much more hardened, there are other points of entry that will be used instead. It does you little good to transform your door into a foot thick slab of concrete if your window is still just a couple panes of glass, or someone can just take a sledgehammer to your wall next to the door and it's just a few sheets of plywood and some 2x4's. Well sure, but like in all security it's about adjusting the attacker's effort/reward ratio. As I recall [citation needed], most burglaries are less than a few minutes, in-and-out affairs. Make it harder than that, and you can deter the low-effort attackers.

bsder 10y ago

While his thesis for things that are related to home security in the face of an adversary are correct, there are a lot more cases that aren't so dire. Gee, someone is banging on my door at 3AM in the morning. I'd really like to see who it is WITHOUT being directly behind the door. Especially since it's most likely to be a neighbor or the police and greeting them with a shotgun is not likely to result in a positive outcome. A cam on my door that I can see from my phone would be kinda useful. My water heater, washer, shower, etc. just broke. I'd really like to get continuous alerts on my phone that there is water filling up my house. There are lots of things like this. They're grubby and mucky and an opportunity, but they are not high volume and they require more than 3 guys and a dog and some software.

acidburnNSA 10y ago
To further your point, I live in a high-crime urban area in an apartment complex that gets broken into weekly by folks stealing packages and prowling cars. My apartment used to have no security, and it would have stayed there if I hadn't gotten into the open source Python 3 home automation engine https://home-assistant.io https://home-assistant.io. I got it up on a Raspberry Pi and fiddled with it for lots of things. Now, if my door opens or motion is detected and the alarm is armed: * My stereo gets turned on by an IR LED * A scary mp3 I threw together with dogs barking, sirens blaring, and monsters growling starts playing loudly * My camera starts taking snapshots and saving them locally and emailing them to me * All the lights in my apt. start blinking on and off If I'm home, this will wake me up if my door gets compromised, and possibly scare off the perp. If I'm not home I will almost certainly get the alert (services are up 99% of the time), and I feel relatively confident that it will scare off a low-level property thief. If professionals show up with SDR to jam my sensors, yeah they'll get in...I agree. But IoT home security is still good because some security is better than none, and there's no way I would have any security at all without it.
- grogenaut 10y ago
  What software defined radio would screw up your sensors? The ones you listed above are all door or ir. Or did you just mean the motion sensors?

fpgaminer 10y ago

I recently looked at the landscape of smart door locks, and came to the same conclusion as @Animats did in his comment. Actually, I would rephrase it to say _all_ smart door locks suck. All I really want right now is an RFID/NFC deadbolt, purely for convenience. Seems simple enough, and yet nothing secure exists. So I'm now set on trying to build my own lock. I'm thinking of just getting a really nice, mechanical deadbolt, and then building something similar in design to Lockitron, where it just sits on top of the deadbolt, augmenting it with digital authentication. For the keycards I plan to combine a low power MCU with NFC and Ed25519 cryptography for authentication. I found a variation of the MSP430 chips with built-in NFC capability which are designed to run battery-less (they harvest energy from the NFC signal). My rough calculations suggest that they'll be able to soak up enough power to do an Ed25519 signature in 0.25 seconds; fast enough for me. I'll just have the lock send a random challenge to the keycard, it responds with a signature of the challenge, and then the lock can verify the signature and confirm that the card is legit. It should be simple enough to mold the MSP430 and supporting electronics into a thin 1" diameter disc which I can hook to my keychain or put in my wallet. Awesome! The lock itself is just another MCU with NFC capabilities, battery, and motor. That setup satisfies my desire for a convenient, digital lock, while maintaining real security (Ed25519 with real random challenges, versus existing RFID solutions which use 48-bit keys, 3DES, suffer replay attacks, etc). I'm surprised these things don't already exist. I only had to spend an hour to find the MSP430 chip variation and sketch out this system...

jschwartzi 10y ago
How secure is the mechanism to tapping or smashing? Does it fail open, or closed?
- fpgaminer 10y ago
  The whole unit is just a motor that actuates an existing deadbolt's thumbturn on the opposite side of the door (i.e. not accessible from the outside world). So failing open/closed is a question for the existing deadbolt, not this device.
amluto 10y ago

niftich 10y ago

The commercial excitement over IoT is all about offering 'services' you couldn't offer before. When your house is full of these devices, some people will pay extra for the 'enhanced tier' of service (even if the basic tier is offered for free). In cases where the business model isn't subscription-based, it's either made up by the high retail price of the device, or indirectly monetizing the data collected for 'market research' and the like. IoT isn't about people hooking up jailbroken Kindles to one-way mirrors to show the weather. It's not about Ardunios and Raspberry Pis being used to collect some data, move some servos, and make a blog post about it. It's about big money to be made by introducing new monetization channels in places there were none before.

euske 10y ago
I've been saying that there are three "scammy" markets which tend to have a higher ratio of overpriced, scammy products, and they're the following: * Health * Education * Office productivity And now, * Home security (New!) The reason that I think these markets tend to be scammy is because their quality is mostly based on perception. And there's no easy way to drastically improve these, people tend to look for a magic pill. And you're right, security is certainly going to be one of them.
- paavokoya 10y ago
  I'd add banking/financial services to that list..
  - ionised 10y ago
    The greatest of all cons.
- nightcracker 10y ago
  The first two bullet points on your list are very specific to an american perspective. As a dutchman I do not consider these scammy markets whatsoever.
  - 10y ago

jimjimjim 10y ago

my guess is that companies are pushing this (rather than customer pull) because: 1) product differentiation, more vague tick boxes on the product comparison chart that your competitors don't have. 2) vendor lockin/ecosystem lockin. If the devices are not going straight to a remote server you'll need a "hub". your brandA lightbulbs will only talk to a brandA house hub which is incompatible with brandB security locks. 3) product churn. (did you really really need to replace your ok tv with one that does 3d? lots of people did). 4) clip the ticket. build a platform that involves transactions and take a cut. 5) data. paraphrasing: if you aren't paying for it, you aren't the customer you're the product. none of these really sound like a utopia for the average person.

sjellis 10y ago
There's also the "Star Trek factor" (I just made us this term). Tech people grow up watching or reading science fiction and then try to build the stuff for real, because it would be cool. We'll have to see if ordinary people find it useful.

yalogin 10y ago

IoT reminds me of the fiber optics craze of the late 90s. No one knew what the killer application for fiber was back then but every company was in it. Eerily similar to whats going on now with IoT.

kordless 10y ago

IoT isn't anything other than what already was. It's decentralized compute, plain and simple.

SigmundA 10y ago

I have had a HAI Omni Pro in my house for nearly a decade, it is a UL listed Fire/Burglary and automation system. It has never faulted or rebooted except when I needed to change its backup battery. There are Omni's running that where made in the 80's. It has a Ethernet port and a documented TCP protocol that uses 256 AES. I have an iOS app that talks to it directly, which means no lag in controlling it. Beyond Security and Fire, it controls my lights, HVAC, garage doors, sprinklers. It is one of the most reliable computing systems I have used. The recent IoT stuff is a joke compared to my Omni, unfortunately I think HAI got left behind and ended up selling out to Leviton and there seems to be little progress since then.

tempodox 10y ago

Laws and regulations may remedy the racket that IoT is now. I'll believe it when I see it.