5 ms·

Is anyone else concerned that tools like Alexa are making the whole automated home thing too easy? I see it as creating a bunch of automation "experts" out of

by tmuir 10y ago

Is anyone else concerned that tools like Alexa are making the whole automated home thing too easy? I see it as creating a bunch of automation "experts" out of people who don't truly understand the whole feature surface/attack surface coupling. There are multiple tutorials on Amazon's website to learn how to implement the whole path, end to end. There are "smart" outlets that are actually pretty dumb, at least when it comes to knowing whats plugged into it. Whats to prevent someone from connecting this to their smart door locks? Then if that person has a big party, and someone with bad intentions shows up, they can simply say "Alexa, at 3:30am tomorrow, turn off the alarm system, and unlock the doors". Or "Alexa, turn off the dialysis machine". Sure Amazon might make it more secure in the future, but probably only after enough of these unintended consequences stack up. I also understand that the average HN reader is probably not rushing out to introduce a single point of failure into their home security system. My point is that Alexa is essentially saying "don't worry about how it happens, just dream big about what awesome stuff might happen".

WalterSear 10y ago
> What's to prevent someone from connecting this to their smart door locks? August (the premiere door lock people) are very careful who they partner with, and wouldn't partner with anyone making an integration like this (they won't partner with my current employer for this very security reason). 2nd & 3rd tier vendors might not be so choosy.
- maxerickson 10y ago
  Grandparent brings to mind "HEY SIRI, UNLOCK THE FRONT DOOR." https://www.reddit.com/r/technology/comments/532gmg/my_neighbor_just_let_himself_into_my_locked_house/ https://www.reddit.com/r/technology/comments/532gmg/my_neigh... I've attached my comment to yours because the story mentions the lock was made by August.
  - supergeek133 10y ago
    I would argue that's a result of the way Homekit and Siri interact, and not the fault of the August Lock. August put the Homekit chip in the device. Apple should really require a code along with the unlock command. It's also why Amazon asked some skill makers to remove unlock functionality recently.
    - DashRattlesnake 10y ago
      > Apple should really require a code along with the unlock command. Which could be easily overheard and remembered or recorded.
      - supergeek133 10y ago
        I could also watch someone put in their code
        DashRattlesnake 10y ago
        It's harder to conceal a spoken command than a keypad-entered code. Spoken words are unavoidably broadcast to nearby surroundings, but you can mask your use of a keypad easily. https://en.wikipedia.org/wiki/Parabolic_microphone https://en.wikipedia.org/wiki/Parabolic_microphone
- deegles 10y ago
  I believe most smart locks integrations right now only let you lock or check lock status, not unlock with voice.
supergeek133 10y ago
Amazon I believe recently asked a number of custom skill makers to remove unlock functionality from their code for this exact reason. Could someone walk by my window and say "Alexa, set the thermostat to 90 degrees?" Sure. That would assume the attacker knows I have a smart thermostat, also they have to know the name of the thermostat in my app. Also, my heat would have to be on for it to really matter, and at the end of the day all it is really doing is increasing my utility bill.
- rch 10y ago
  Great example, because this actually happened as a result of an NPR story about Alexa: http://www.npr.org/2016/03/06/469383361/listen-up-your-ai-assistant-goes-crazy-for-npr-too http://www.npr.org/2016/03/06/469383361/listen-up-your-ai-as...
  - supergeek133 10y ago
    Yep, during the last Super Bowl my Alexa triggered 3 times.
machbio 10y ago
This Exactly.. I am really afraid to connect advanced skillsets like Uber on my Echo - for that there is no authentication methods on Echo.. To add to the rant, the Amazon Alexa is one of the worst android application with constant unresponsiveness and I am not sure they can deliver on a method where the authentication can be through the Alexa App for the advanced skills

by tmuir 10y ago

WalterSear 10y ago

> What's to prevent someone from connecting this to their smart door locks? August (the premiere door lock people) are very careful who they partner with, and wouldn't partner with anyone making an integration like this (they won't partner with my current employer for this very security reason). 2nd & 3rd tier vendors might not be so choosy.

maxerickson 10y ago
Grandparent brings to mind "HEY SIRI, UNLOCK THE FRONT DOOR." https://www.reddit.com/r/technology/comments/532gmg/my_neighbor_just_let_himself_into_my_locked_house/ https://www.reddit.com/r/technology/comments/532gmg/my_neigh... I've attached my comment to yours because the story mentions the lock was made by August.
- supergeek133 10y ago
  I would argue that's a result of the way Homekit and Siri interact, and not the fault of the August Lock. August put the Homekit chip in the device. Apple should really require a code along with the unlock command. It's also why Amazon asked some skill makers to remove unlock functionality recently.
  - DashRattlesnake 10y ago
    > Apple should really require a code along with the unlock command. Which could be easily overheard and remembered or recorded.
    - supergeek133 10y ago
      I could also watch someone put in their code
      - DashRattlesnake 10y ago
        It's harder to conceal a spoken command than a keypad-entered code. Spoken words are unavoidably broadcast to nearby surroundings, but you can mask your use of a keypad easily. https://en.wikipedia.org/wiki/Parabolic_microphone https://en.wikipedia.org/wiki/Parabolic_microphone
deegles 10y ago
I believe most smart locks integrations right now only let you lock or check lock status, not unlock with voice.

supergeek133 10y ago

Amazon I believe recently asked a number of custom skill makers to remove unlock functionality from their code for this exact reason. Could someone walk by my window and say "Alexa, set the thermostat to 90 degrees?" Sure. That would assume the attacker knows I have a smart thermostat, also they have to know the name of the thermostat in my app. Also, my heat would have to be on for it to really matter, and at the end of the day all it is really doing is increasing my utility bill.

rch 10y ago
Great example, because this actually happened as a result of an NPR story about Alexa: http://www.npr.org/2016/03/06/469383361/listen-up-your-ai-assistant-goes-crazy-for-npr-too http://www.npr.org/2016/03/06/469383361/listen-up-your-ai-as...
- supergeek133 10y ago
  Yep, during the last Super Bowl my Alexa triggered 3 times.

machbio 10y ago

This Exactly.. I am really afraid to connect advanced skillsets like Uber on my Echo - for that there is no authentication methods on Echo.. To add to the rant, the Amazon Alexa is one of the worst android application with constant unresponsiveness and I am not sure they can deliver on a method where the authentication can be through the Alexa App for the advanced skills