12 ms·

Security is expensive for vendors to implement, so they externalize the risks to their customers and society in general. To reverse this dynamic, "insecure by

Security is expensive for vendors to implement, so they externalize the risks to their customers and society in general. To reverse this dynamic, "insecure by default" needs to be more expensive than "secure by default". It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech, and rather simply make the vendors legally liable for damages and let the market evolve effective standards and practices. However, constructing effective legislation/regulation for doing so is a non-trivial legal challenge. Simply proving when the vendor is liable vs a user could get tricky, as well as estimating damages and divying them up among multiple vendors if damages involved products from multiple vendors. Among other things. Anyone, especially lawyers, have insight on best way to fix this problem?

jldugger 10y ago
All the software you use likely already came with a liability waiver / disclaimer: > IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
- kazagistar 10y ago
  And regulations can make all such waivers nonbinding in whatever cases are deemed important enough, like IoT devices for example.
- pythonaut_16 10y ago
  The key point being > UNLESS REQUIRED BY APPLICABLE LAW Not to mention that liability waivers and disclaimers can never supersede the law anyway.
rapsey 10y ago
> It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech Govs can do a lot of broad legislation rules that is non-specific. The software industry requires a legislative bitch slap like the auto industry received. These rules would wreak havoc on the industry but if you ask me for the better. - Are you running unpatched software exposed to the internet for which CVE patches exist? Pay a fine every day until you do so. - Ban IoT devices that do not have automatic signed software updates over encrypted channels (which would probably ban all current IoT devices). - Ban all IoT devices without crypto capabilities. Must have a hardware RNG and a set of standard crypto algorithms. - Does an IoT maker have a CVE and has not patched all their devices in X amount of time? Daily fine. - Are you a vendor who has not patched a CVE for your software after X amount of time? Pay a fine every day until you do so.
- sillysaurus3 10y ago
  This would have the wonderful effect of making the CVE yet another tool that can hold corporations hostage in exchange for money. Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse.
  - PhasmaFelis 10y ago
    > Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse. How so? I mean, I'd rather avoid either, but if I had to pick one, I don't get what's so special about "startups" that they're more important than data security.
    - dwaltrip 10y ago
      People starting new businesses is usually a good way for a society to become wealthier and to also raise the standard of living. In this particular case, I have no idea whether or not the safety risks/externalities are severe enough that added regulation is needed.
zardo 10y ago
There's nothing stopping civil suits for damages resulting from poor security now. If your product does harm, you aren't absolved of liability because the internet was involved.
- chopin 10y ago
  There all disclaimers all over the place for exactly this situation. You'll need to outlaw these.
  - kryptiskt 10y ago
    All the ones used in open source licenses? We're playing with fire here.
  - zardo 10y ago
    You can't wave your liability for neglegence. A disclaimer is legal armor, but it's not impenetrable armor.
astrodust 10y ago
It's actually not that hard to find a framework for a solution. If you sell anything that connects to the power grid, you need to get it UL Listed. No exceptions. You cannot sell it if it doesn't check out in the lab. If you sell anything that emits radio frequencies either as part of its fundamental operation, or as incidental to it, you must get FCC certification. Why isn't there an agency like this, or a subdivision of one of those existing ones, that certifies things for being able to connect to the internet? Right now there's absolutely no way for an ordinary consumer to know if that product they're buying is rock solid or absolute trash. Enormous corporations like Samsung consistently crank out some of the most appallingly slip-shod code, and relatively tiny companies like those behind the Pebble have a considerably better track record. There's no external signs for the non-technical people to work with here. They'll need to hope and pray that their product isn't a total turkey.
- mtreis86 10y ago
  How many people in the world have studied crypto? Radio and EE are both areas studied by a magnitude greater number of people at a serious level. Does crypto take a higher level of cognitive overhead to enter or do people only think it does? Is there a cryto structure similar to amateur radio?
  - astrodust 10y ago
    It doesn't have to be crypto. Right now a basic check done by a post-grad student could probably catch 90% of the most glaring problems. Your dishwasher has an HTTP port open? That's not good. Your webcam uses port-popping UDP to open up a VPN to some random server in China? Yeah, we're not certifying that. We're talking about basic port mapping and monitoring of the device in operation to make sure the network activity observed has some reasonable correlation to the actions performed on the device. Most consumers don't have the tools to do this, nor the patience to perform these tests, but these tools are cheap and easy to use by anyone with the inclination. You can do additional fuzz testing quite easily, plus inspect the data stream for plain-text data that should be encrypted. If as part of the certification you needed to submit a document describing what encryption methods you use and what system you have in place for dealing with compromised keys and such, great, but I don't see that as strictly necessary. Considerable improvements to the marketplace can be made with very simple tests. This is the equivalent of plugging in an electrical device, observing it catches on fire, and giving it a failing grade. No specific knowledge of electronics is required.
rmc 10y ago
Making vendors liable has the problem when they spin up a new incorporated entity every year. The company who made it is now bust! Who is liable?
- chopin 10y ago
  The owner. If you can't patch it, put it off the grid. If owners become liable they will care whether companies will be able to provide fixes in the future. A somewhat radical solution: if an IoT device has vulnerabilities you go free in bricking it (=making the device non-functional, nothing else). This will put strong incentives on secure devices.
macspoofing 10y ago
>Anyone, especially lawyers, have insight on best way to fix this problem? Why lawyers? This is a technical problem. Layers will come up with bad legal solutions that will already be outdated and probably too onerous when they are finally passed. I think the fix is obvious. IoT device should not have an open connection to the internet. You want to control the lights in your house with your phone, when you're at work? VPN to your home network and do it. Obviously people won't know how to configure a VPN, and you can't expect a Chinese IoT manufacturer to not have a a web-server listening on a standard port or issue weekly security updates for the lifetime of the product, but this could be automated by smart routers like Google Home/Wifi. Frankly, this is probably going to happen anyway. OS vendors have largely removed the OS as the most vulnerable component of a home network. All OSes are either locked down (Android/iOS) or have continuous security updates with sane out-of-the-box defaults. That leaves the router as a critical weak point. The cheapo $30 Staples router may work great for a household, but it isn't getting monthly security updates and is probably running on an unsupported kernel with a whole swath of zero-day vulnerabilities.
- lmm 10y ago
  Have you ever had to follow coding standards that are 10 years out of date? I have and it was worse than working retail. Technology moves too fast. (And for what it's worth a VPN is a non-solution to the wrong problem in this case). Legal is absolutely the right place for the problem. Put the liability in the right place and companies will figure out what works and what doesn't.
  - macspoofing 10y ago
    >Have you ever had to follow coding standards that are 10 years out of date? I have. Our product is 10 years old. 10 years is nothing. And I'm not sure what your point is, any regulation is going to take years to develop, and years to be assimilated (if ever). >Put the liability in the right place and companies will figure out what works and what doesn't. Uh huh. You're proposing creating regulation to govern thousands (or hundreds of thousands) of products globally, and you think that's easier? The closest example of a regulatory solution to a real technical problem is the EU mandate of cookie notification ... which was disruptive for everyone and insanely stupid and pointless. >(And for what it's worth a VPN is a non-solution to the wrong problem in this case). It's a solution. The problem with IoT devices is that they are open for anyone to compromise and you cannot expect manufacturers to support them with security updates indefinitely. You put them on a private network with a controlled end-point and you're 95% there. Instead of needing people to vet every device they buy on Amazon (or creating a regulatory body to govern and control them), you just need to convince them to get a 'smart' router. You don't need every IoT manufacturer in the world to play ball. You don't even need every consumer to play ball either. Your phone will have an app that will talk to your home router/gateway and you can access your home service via a VPN you don't even know is there. Makes a ton of sense to me. Regulation would be a mess.

jldugger 10y ago

All the software you use likely already came with a liability waiver / disclaimer: > IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

kazagistar 10y ago
And regulations can make all such waivers nonbinding in whatever cases are deemed important enough, like IoT devices for example.
pythonaut_16 10y ago
The key point being > UNLESS REQUIRED BY APPLICABLE LAW Not to mention that liability waivers and disclaimers can never supersede the law anyway.

rapsey 10y ago

> It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech Govs can do a lot of broad legislation rules that is non-specific. The software industry requires a legislative bitch slap like the auto industry received. These rules would wreak havoc on the industry but if you ask me for the better. - Are you running unpatched software exposed to the internet for which CVE patches exist? Pay a fine every day until you do so. - Ban IoT devices that do not have automatic signed software updates over encrypted channels (which would probably ban all current IoT devices). - Ban all IoT devices without crypto capabilities. Must have a hardware RNG and a set of standard crypto algorithms. - Does an IoT maker have a CVE and has not patched all their devices in X amount of time? Daily fine. - Are you a vendor who has not patched a CVE for your software after X amount of time? Pay a fine every day until you do so.

sillysaurus3 10y ago
This would have the wonderful effect of making the CVE yet another tool that can hold corporations hostage in exchange for money. Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse.
- PhasmaFelis 10y ago
  > Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse. How so? I mean, I'd rather avoid either, but if I had to pick one, I don't get what's so special about "startups" that they're more important than data security.
  - dwaltrip 10y ago
    People starting new businesses is usually a good way for a society to become wealthier and to also raise the standard of living. In this particular case, I have no idea whether or not the safety risks/externalities are severe enough that added regulation is needed.

zardo 10y ago

There's nothing stopping civil suits for damages resulting from poor security now. If your product does harm, you aren't absolved of liability because the internet was involved.

chopin 10y ago
There all disclaimers all over the place for exactly this situation. You'll need to outlaw these.
- kryptiskt 10y ago
  All the ones used in open source licenses? We're playing with fire here.
- zardo 10y ago
  You can't wave your liability for neglegence. A disclaimer is legal armor, but it's not impenetrable armor.

astrodust 10y ago

It's actually not that hard to find a framework for a solution. If you sell anything that connects to the power grid, you need to get it UL Listed. No exceptions. You cannot sell it if it doesn't check out in the lab. If you sell anything that emits radio frequencies either as part of its fundamental operation, or as incidental to it, you must get FCC certification. Why isn't there an agency like this, or a subdivision of one of those existing ones, that certifies things for being able to connect to the internet? Right now there's absolutely no way for an ordinary consumer to know if that product they're buying is rock solid or absolute trash. Enormous corporations like Samsung consistently crank out some of the most appallingly slip-shod code, and relatively tiny companies like those behind the Pebble have a considerably better track record. There's no external signs for the non-technical people to work with here. They'll need to hope and pray that their product isn't a total turkey.

mtreis86 10y ago
How many people in the world have studied crypto? Radio and EE are both areas studied by a magnitude greater number of people at a serious level. Does crypto take a higher level of cognitive overhead to enter or do people only think it does? Is there a cryto structure similar to amateur radio?
- astrodust 10y ago
  It doesn't have to be crypto. Right now a basic check done by a post-grad student could probably catch 90% of the most glaring problems. Your dishwasher has an HTTP port open? That's not good. Your webcam uses port-popping UDP to open up a VPN to some random server in China? Yeah, we're not certifying that. We're talking about basic port mapping and monitoring of the device in operation to make sure the network activity observed has some reasonable correlation to the actions performed on the device. Most consumers don't have the tools to do this, nor the patience to perform these tests, but these tools are cheap and easy to use by anyone with the inclination. You can do additional fuzz testing quite easily, plus inspect the data stream for plain-text data that should be encrypted. If as part of the certification you needed to submit a document describing what encryption methods you use and what system you have in place for dealing with compromised keys and such, great, but I don't see that as strictly necessary. Considerable improvements to the marketplace can be made with very simple tests. This is the equivalent of plugging in an electrical device, observing it catches on fire, and giving it a failing grade. No specific knowledge of electronics is required.

rmc 10y ago

Making vendors liable has the problem when they spin up a new incorporated entity every year. The company who made it is now bust! Who is liable?

chopin 10y ago
The owner. If you can't patch it, put it off the grid. If owners become liable they will care whether companies will be able to provide fixes in the future. A somewhat radical solution: if an IoT device has vulnerabilities you go free in bricking it (=making the device non-functional, nothing else). This will put strong incentives on secure devices.

macspoofing 10y ago

>Anyone, especially lawyers, have insight on best way to fix this problem? Why lawyers? This is a technical problem. Layers will come up with bad legal solutions that will already be outdated and probably too onerous when they are finally passed. I think the fix is obvious. IoT device should not have an open connection to the internet. You want to control the lights in your house with your phone, when you're at work? VPN to your home network and do it. Obviously people won't know how to configure a VPN, and you can't expect a Chinese IoT manufacturer to not have a a web-server listening on a standard port or issue weekly security updates for the lifetime of the product, but this could be automated by smart routers like Google Home/Wifi. Frankly, this is probably going to happen anyway. OS vendors have largely removed the OS as the most vulnerable component of a home network. All OSes are either locked down (Android/iOS) or have continuous security updates with sane out-of-the-box defaults. That leaves the router as a critical weak point. The cheapo $30 Staples router may work great for a household, but it isn't getting monthly security updates and is probably running on an unsupported kernel with a whole swath of zero-day vulnerabilities.

lmm 10y ago
Have you ever had to follow coding standards that are 10 years out of date? I have and it was worse than working retail. Technology moves too fast. (And for what it's worth a VPN is a non-solution to the wrong problem in this case). Legal is absolutely the right place for the problem. Put the liability in the right place and companies will figure out what works and what doesn't.
- macspoofing 10y ago
  >Have you ever had to follow coding standards that are 10 years out of date? I have. Our product is 10 years old. 10 years is nothing. And I'm not sure what your point is, any regulation is going to take years to develop, and years to be assimilated (if ever). >Put the liability in the right place and companies will figure out what works and what doesn't. Uh huh. You're proposing creating regulation to govern thousands (or hundreds of thousands) of products globally, and you think that's easier? The closest example of a regulatory solution to a real technical problem is the EU mandate of cookie notification ... which was disruptive for everyone and insanely stupid and pointless. >(And for what it's worth a VPN is a non-solution to the wrong problem in this case). It's a solution. The problem with IoT devices is that they are open for anyone to compromise and you cannot expect manufacturers to support them with security updates indefinitely. You put them on a private network with a controlled end-point and you're 95% there. Instead of needing people to vet every device they buy on Amazon (or creating a regulatory body to govern and control them), you just need to convince them to get a 'smart' router. You don't need every IoT manufacturer in the world to play ball. You don't even need every consumer to play ball either. Your phone will have an app that will talk to your home router/gateway and you can access your home service via a VPN you don't even know is there. Makes a ton of sense to me. Regulation would be a mess.