52 ms·

>A huge number of IoT devices don't need the 'I'. They are perfectly capable of serving their purpose without an Internet connection (e.g. over Bluetooth,) but

>A huge number of IoT devices don't need the 'I'. They are perfectly capable of serving their purpose without an Internet connection (e.g. over Bluetooth,) but a huge attack surface is added to make you able to configure the device via a central website, or simply to monetize usage data. I always feel the need to disagree with this. The biggest "value add" in most of my "connected" stuff is the fact that I can access and manage it from outside the home. Z-Wave light switches are nice, but being able to turn them off when I forgot to after i've left is a huge bonus (and taking it a step further and tracking my and my families phones and turning them all off when nobody is home automatically). A thermostat I can control when I'm on the couch is a convenience, but a thermostat that notices when I'm at work or the store or a friends house and turns off during that time saves tons of money and energy. A garage door that I can control from anywhere in my house is normal, but a garage door that I can have ensure it's closed when i'm not home, and that I can open for a friend that showed up to my house 20 minutes before I did is awesome. I really do think that the "I" in IoT is absolutely necessary (in many cases, not all), but I agree with the rest of your points. (before people start commenting on the tracking stuff, it's all implemented on a home-server where the phones literally "phone home" to that server, nothing is processed outside the house)

patrickmn 10y ago
By all means, if the Internet connection serves a purpose, great. But a sleep monitoring gadget probably doesn't need an Internet connection just to show your sleep score. For all the flak Fitbit has gotten, at least it gets this right (syncs over Bluetooth.)
mbreese 10y ago
All of those are great use-cases. But do you really want each of those devices to be added to the external threat surface? Perhaps it would be better to have everything talk to a central hub over a local protocol (ZigBee, Bluetooth, etc) and then that hub be the main connection out to the Internet at large. As it is now, it's still a bit of a free for all. And at least if you have a hub model where you can secure that one device (or replace it if it is compromised), you don't have to replace all of your individual IoT devices when something bad does happen. A good example of this is my garage door opener. Instead of building a WiFi connection into the opener itself, there is a separate little gateway device that sits inside my house. The gateway talks to the door (RF) and to the Internet (ethernet). I can still control my garage door, but if something is compromised, I can always detach that gateway and still have a working (secure) garage door.
- Klathmon 10y ago
  It seems so silly to me to not use the ubiquitous "RF" broadcasting stations already in everyone's house, that also includes an "okay" addressing system, a security firewall, high bandwidth communications protocol, and more. Why not focus on software which can use WiFi more securely and with a better focus on local connectivity? I can understand the "ultra low power" needs, but many of these devices are mains powered, and that's not really a concern. But yes, what I do right now for the most part is use z-wave which is connected to a central "hub" which is then connected to the outside world. But IMO that's a hacky-workaround for this problem, not a real solution.
- jaclaz 10y ago
  OT, but not much, there was a story recently about the Garadget: https://news.ycombinator.com/item?id=14029572 https://news.ycombinator.com/item?id=14029572 which shows some of the risks of an internet connected device (no, it is not about lack of security)
- ryandrake 10y ago
  This is a great idea, but it would inevitably fail. All we'd end up with is each and every IoT company coming out with their own "hub" product that only works with it's own devices. Want to control Philips Hue bulbs? You have to have a Philips IoT hub connected to the Internet. Belkin smart plugs? They'll connect only to a Belkin smart hub. Xyz Manufacturer sprinkler system? Xyz hub. Oh, and by the way, those hubs will all have insecure software thrown together by an underpaid E.E. too.
detaro 10y ago
If router security weren't such a mess as well, that'd be the perfect integration point. Better home routers already can provide VPN connections, have apps for mobile devices to set those up, can isolate different devices in the local network ("guest WLAN", "child protection" features), ... At the same time, a lot of IoT stuff only connects to the outside to be reachable by its apps, and maybe sent notifications. The router could manage these things instead, independent of any device-specific "cloud" service.
- Klathmon 10y ago
  I do think a large part of the reason so many devices need "internet" access is because we (as developers) have failed to come up with a good way of accessing these things locally. So many things in my house have static IP addresses because I want to access them locally, it's an absolute pain in the ass and not at all something that your average person could manage. Having an IoT device send all of it's data to a "cloud" server is the easiest and most fullproof way to make sure everyone can use see it. Without that, you are looking at complicated local addressing systems, hoping that your users aren't using client isolation or something like it (and you WILL get calls because they tried to use the device on a hotel network where each client is isolated and it didn't work), and ugly URLs at best.
mrob 10y ago
You don't need IoT for any of those use cases. For the first two you just need occupancy detection. You can do that locally with passive infrared sensors. And for letting your friend into your garage you just need a keypad lock. They can phone you and ask for the code. If the lock supports multiple codes you can tell them only the backup code so you can change it and lock them out again later without inconveniencing yourself.
- Klathmon 10y ago
  >You don't need IoT for any of those use cases. This is a shitty response. It's like telling the person who wants a better mousetrap to just live somewhere that doesn't have mice. It might be a "solution" but it's not a good one. >You can do that locally with passive infrared sensors. So now you want me to purchase 10+ infrared sensors for throughout my small condo? And what happens when my pets set them off? what happens when I'm laying still on the couch? What happens when I'm taking a shower? I can just get a keypad? what happens when I want to change my keycode while I'm away for a week? What about the nice notification I get on my phone when someone opens a door or the garage door when I'm not home? What about the snapshot of the security camera I have sent to my phone every time someone enters the house when nobody is home? What about the routine which begins warming/cooling my house when i'm less than 15 minutes from home? Those aren't solutions, they are shitty workarounds that only work in a fraction of the situations. Just like most other "solutions" that attempt to act like every single thing is 100% possible without outside communication are.
  - mrob 10y ago
    PIR sensors are reasonably cheap and have low power consumption. They could be battery powered and connected to a local low-power wireless network (transmitting only, and at low data rate), which would make installation easy. It wouldn't take much battery capacity to beat the expected lifespan of a IoT device. They're generally good at discriminating between humans and pets, but if a pet did trigger it the worst that would happen is you waste a little electricity or fuel as you give it some light or heat you didn't intend to. You stand to lose much more if somebody hacks your internet connected solution. And if you're laying still enough to avoid triggering a PIR sensor you're probably sleeping and want the light off. And most phones are not waterproof so they cannot be used in the shower, so IoT does no better there. I think it's unlikely that the IoT door lock features add enough security to make up for the increased attack surface compared to the local only version.

patrickmn 10y ago

By all means, if the Internet connection serves a purpose, great. But a sleep monitoring gadget probably doesn't need an Internet connection just to show your sleep score. For all the flak Fitbit has gotten, at least it gets this right (syncs over Bluetooth.)

mbreese 10y ago

All of those are great use-cases. But do you really want each of those devices to be added to the external threat surface? Perhaps it would be better to have everything talk to a central hub over a local protocol (ZigBee, Bluetooth, etc) and then that hub be the main connection out to the Internet at large. As it is now, it's still a bit of a free for all. And at least if you have a hub model where you can secure that one device (or replace it if it is compromised), you don't have to replace all of your individual IoT devices when something bad does happen. A good example of this is my garage door opener. Instead of building a WiFi connection into the opener itself, there is a separate little gateway device that sits inside my house. The gateway talks to the door (RF) and to the Internet (ethernet). I can still control my garage door, but if something is compromised, I can always detach that gateway and still have a working (secure) garage door.

Klathmon 10y ago
It seems so silly to me to not use the ubiquitous "RF" broadcasting stations already in everyone's house, that also includes an "okay" addressing system, a security firewall, high bandwidth communications protocol, and more. Why not focus on software which can use WiFi more securely and with a better focus on local connectivity? I can understand the "ultra low power" needs, but many of these devices are mains powered, and that's not really a concern. But yes, what I do right now for the most part is use z-wave which is connected to a central "hub" which is then connected to the outside world. But IMO that's a hacky-workaround for this problem, not a real solution.
jaclaz 10y ago
OT, but not much, there was a story recently about the Garadget: https://news.ycombinator.com/item?id=14029572 https://news.ycombinator.com/item?id=14029572 which shows some of the risks of an internet connected device (no, it is not about lack of security)
ryandrake 10y ago
This is a great idea, but it would inevitably fail. All we'd end up with is each and every IoT company coming out with their own "hub" product that only works with it's own devices. Want to control Philips Hue bulbs? You have to have a Philips IoT hub connected to the Internet. Belkin smart plugs? They'll connect only to a Belkin smart hub. Xyz Manufacturer sprinkler system? Xyz hub. Oh, and by the way, those hubs will all have insecure software thrown together by an underpaid E.E. too.

detaro 10y ago

If router security weren't such a mess as well, that'd be the perfect integration point. Better home routers already can provide VPN connections, have apps for mobile devices to set those up, can isolate different devices in the local network ("guest WLAN", "child protection" features), ... At the same time, a lot of IoT stuff only connects to the outside to be reachable by its apps, and maybe sent notifications. The router could manage these things instead, independent of any device-specific "cloud" service.

Klathmon 10y ago
I do think a large part of the reason so many devices need "internet" access is because we (as developers) have failed to come up with a good way of accessing these things locally. So many things in my house have static IP addresses because I want to access them locally, it's an absolute pain in the ass and not at all something that your average person could manage. Having an IoT device send all of it's data to a "cloud" server is the easiest and most fullproof way to make sure everyone can use see it. Without that, you are looking at complicated local addressing systems, hoping that your users aren't using client isolation or something like it (and you WILL get calls because they tried to use the device on a hotel network where each client is isolated and it didn't work), and ugly URLs at best.

mrob 10y ago

You don't need IoT for any of those use cases. For the first two you just need occupancy detection. You can do that locally with passive infrared sensors. And for letting your friend into your garage you just need a keypad lock. They can phone you and ask for the code. If the lock supports multiple codes you can tell them only the backup code so you can change it and lock them out again later without inconveniencing yourself.

Klathmon 10y ago
>You don't need IoT for any of those use cases. This is a shitty response. It's like telling the person who wants a better mousetrap to just live somewhere that doesn't have mice. It might be a "solution" but it's not a good one. >You can do that locally with passive infrared sensors. So now you want me to purchase 10+ infrared sensors for throughout my small condo? And what happens when my pets set them off? what happens when I'm laying still on the couch? What happens when I'm taking a shower? I can just get a keypad? what happens when I want to change my keycode while I'm away for a week? What about the nice notification I get on my phone when someone opens a door or the garage door when I'm not home? What about the snapshot of the security camera I have sent to my phone every time someone enters the house when nobody is home? What about the routine which begins warming/cooling my house when i'm less than 15 minutes from home? Those aren't solutions, they are shitty workarounds that only work in a fraction of the situations. Just like most other "solutions" that attempt to act like every single thing is 100% possible without outside communication are.
- mrob 10y ago
  PIR sensors are reasonably cheap and have low power consumption. They could be battery powered and connected to a local low-power wireless network (transmitting only, and at low data rate), which would make installation easy. It wouldn't take much battery capacity to beat the expected lifespan of a IoT device. They're generally good at discriminating between humans and pets, but if a pet did trigger it the worst that would happen is you waste a little electricity or fuel as you give it some light or heat you didn't intend to. You stand to lose much more if somebody hacks your internet connected solution. And if you're laying still enough to avoid triggering a PIR sensor you're probably sleeping and want the light off. And most phones are not waterproof so they cannot be used in the shower, so IoT does no better there. I think it's unlikely that the IoT door lock features add enough security to make up for the increased attack surface compared to the local only version.