5 ms·

Working in the space (Disclaimer: I work for Honeywell) I can tell you this is one of the things that is really hard to communicate to customers in terms of IoT

Working in the space (Disclaimer: I work for Honeywell) I can tell you this is one of the things that is really hard to communicate to customers in terms of IoT: You get what you pay for in some respects. Some of these products are more expensive than their counterparts because of the amount of time and effort put into security and overall design of the product. But if I see a deal online for $200 home security DIY and my closest pro install costs $X over Y years, the actual technical security of the product doesn't come first in a consumer's mind. I know until I worked in the space, I can't say I thought of it either.

hannob 10y ago
> You get what you pay for in some respects. Is that the case? It was my impression that the lack of security is pretty much ubiquitous in the IoT space and expensive brands basically do all the same crap. Is there any vendor that stands out, e.g. by saying "we'll do security reviews and guarantee updates when vulnerabilites show up for at least X years"?
- supergeek133 10y ago
  One example I like to use (personally, not as Honeywell) is Blackhat/Defcon from a year ago (I forget which). They showed a ransomware takeover of a thermostat. Everyone started freaking out. Here is what they didn't say though: - You needed physical access - Thermostats are replaceable (as in put a new one on the wall) - It was not a major brand to my knowledge. Something you have to think about is path of least resistance.
stedaniels 10y ago
<moan> I'm on 4.3.0 of the Total Connect Comfort Intl app on Android. You should really stop it jumping to focus (when I'm in another app) and telling me it's lost network connection every time I jump from wi-fi to 4g and back.</moan> You should have a nice open road map and feature request site for the app. An open documented rest API would be great. Android app Intents would be handy. Your support guys are exceptionally good at communication and have great patience. Especially Adrian G! Apologies for the unsolicited feedback...
- supergeek133 10y ago
  > An open documented rest API would be great. I work on this: https://developer.honeywell.com https://developer.honeywell.com I also wrote some of our Alexa skills. Our security systems having an Open API is half a technical problem and half a legal/PR one, as you can imagine. That being said.. there are some scraped projects out there. Oh, and I believe I saw a really slick looking HTML5 version of Total Connect. I can ask.
unholythree 10y ago
That's funny because I immediately thought of the Honeywell Vista 50p when I saw this headline, and various alarm system forums I've lurked in. Something dumb, hardwired, and preferably with a couple of way to call out over a phone line really seems like the best option in my opinion. That said something like the Vista doesn't seem impossible to install yourself for someone with a basic understanding of electrical circuits.
- supergeek133 10y ago
  IMO it's not, but I have a background in such things. We just don't sell them direct to consumers.
rietta 10y ago
When I bought my current house it had a hardwired Vista system (ADT branded) but the main board seems to be burned out. I thought it might be the capacititors on the power supply, but after removing them it seems they check out on the meter. It's the 2008 firmware and ADT wants a fortune. Am I better off wiring up a Raspberry Pi to the wired sensors and getting started with my own software defined system or buying a new Vista Ademco board on ebay? If I get the system working again, I have options for more affordable monitoring. The idea of self monitoring via email alerts from the Raspberry Pi is appealing.
- supergeek133 10y ago
  I'm not super familiar with how the wired sensors work, I'm more on the connected thermostat end. Learning more about security though. I know more of our high/mid end systems use all wireless sensors now.
  - rietta 10y ago
    It is my understanding that they behave like a simple switch so perfect for easy use with the GPIO pins. There are a few wireless sensors (window and sliding glass door) and I don't know how they will behave. There is a board that was connected to the burned out main board with the antennae for it. There are 3 keypads and it is unknown what it would take to communicate with them. If I go the Pi route, I can just make a SSL encrypted page for my wife and I to access via our smartphones.
dazhbog 10y ago
I used to work on a product that was integrating with Honeywell security grade 2-3 panels. These are panels that are used for businesses and airports (grade 4 is the highest). Those panels were using an encoding scheme (s-box at best) to relay data on the peripherals (rs485, rs232) and over the phone line, and if you had a network card (fancy) the same was going on over the network. The user had the option to enable "encryption" from the panel, but his installer could dial in over the phone line supply a 4 digit pin and disable encryption!!!

hannob 10y ago

> You get what you pay for in some respects. Is that the case? It was my impression that the lack of security is pretty much ubiquitous in the IoT space and expensive brands basically do all the same crap. Is there any vendor that stands out, e.g. by saying "we'll do security reviews and guarantee updates when vulnerabilites show up for at least X years"?

supergeek133 10y ago
One example I like to use (personally, not as Honeywell) is Blackhat/Defcon from a year ago (I forget which). They showed a ransomware takeover of a thermostat. Everyone started freaking out. Here is what they didn't say though: - You needed physical access - Thermostats are replaceable (as in put a new one on the wall) - It was not a major brand to my knowledge. Something you have to think about is path of least resistance.

stedaniels 10y ago

<moan> I'm on 4.3.0 of the Total Connect Comfort Intl app on Android. You should really stop it jumping to focus (when I'm in another app) and telling me it's lost network connection every time I jump from wi-fi to 4g and back.</moan> You should have a nice open road map and feature request site for the app. An open documented rest API would be great. Android app Intents would be handy. Your support guys are exceptionally good at communication and have great patience. Especially Adrian G! Apologies for the unsolicited feedback...

supergeek133 10y ago
> An open documented rest API would be great. I work on this: https://developer.honeywell.com https://developer.honeywell.com I also wrote some of our Alexa skills. Our security systems having an Open API is half a technical problem and half a legal/PR one, as you can imagine. That being said.. there are some scraped projects out there. Oh, and I believe I saw a really slick looking HTML5 version of Total Connect. I can ask.

unholythree 10y ago

That's funny because I immediately thought of the Honeywell Vista 50p when I saw this headline, and various alarm system forums I've lurked in. Something dumb, hardwired, and preferably with a couple of way to call out over a phone line really seems like the best option in my opinion. That said something like the Vista doesn't seem impossible to install yourself for someone with a basic understanding of electrical circuits.

supergeek133 10y ago
IMO it's not, but I have a background in such things. We just don't sell them direct to consumers.

rietta 10y ago

When I bought my current house it had a hardwired Vista system (ADT branded) but the main board seems to be burned out. I thought it might be the capacititors on the power supply, but after removing them it seems they check out on the meter. It's the 2008 firmware and ADT wants a fortune. Am I better off wiring up a Raspberry Pi to the wired sensors and getting started with my own software defined system or buying a new Vista Ademco board on ebay? If I get the system working again, I have options for more affordable monitoring. The idea of self monitoring via email alerts from the Raspberry Pi is appealing.

supergeek133 10y ago
I'm not super familiar with how the wired sensors work, I'm more on the connected thermostat end. Learning more about security though. I know more of our high/mid end systems use all wireless sensors now.
- rietta 10y ago
  It is my understanding that they behave like a simple switch so perfect for easy use with the GPIO pins. There are a few wireless sensors (window and sliding glass door) and I don't know how they will behave. There is a board that was connected to the burned out main board with the antennae for it. There are 3 keypads and it is unknown what it would take to communicate with them. If I go the Pi route, I can just make a SSL encrypted page for my wife and I to access via our smartphones.

dazhbog 10y ago

I used to work on a product that was integrating with Honeywell security grade 2-3 panels. These are panels that are used for businesses and airports (grade 4 is the highest). Those panels were using an encoding scheme (s-box at best) to relay data on the peripherals (rs485, rs232) and over the phone line, and if you had a network card (fancy) the same was going on over the network. The user had the option to enable "encryption" from the panel, but his installer could dial in over the phone line supply a 4 digit pin and disable encryption!!!