I can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. There are already safe

I can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. There are already safety standards and according mandatory certification processes in place that (should) prevent electric appliances from burning down your house (CE) or from bringing down airplanes (FCC). What is (urgently) needed is a similar approach to mandatory IT security certification for IoT devices. This is also advocated by Bruce Schneier [0]: Security engineers are working on technologies that can mitigate much of this risk, but many solutions won't be deployed without government involvement. This is not something that the market can solve. Like data privacy, the risks and solutions are too technical for most people and organizations to understand; companies are motivated to hide the insecurity of their own systems from their customers, their users, and the public [...] [0] https://www.schneier.com/blog/archives/2016/07/real-world_secu.html https://www.schneier.com/blog/archives/2016/07/real-world_se...