2 ms·

It's actually not that hard to find a framework for a solution. If you sell anything that connects to the power grid, you need to get it UL Listed. No exceptio

It's actually not that hard to find a framework for a solution. If you sell anything that connects to the power grid, you need to get it UL Listed. No exceptions. You cannot sell it if it doesn't check out in the lab. If you sell anything that emits radio frequencies either as part of its fundamental operation, or as incidental to it, you must get FCC certification. Why isn't there an agency like this, or a subdivision of one of those existing ones, that certifies things for being able to connect to the internet? Right now there's absolutely no way for an ordinary consumer to know if that product they're buying is rock solid or absolute trash. Enormous corporations like Samsung consistently crank out some of the most appallingly slip-shod code, and relatively tiny companies like those behind the Pebble have a considerably better track record. There's no external signs for the non-technical people to work with here. They'll need to hope and pray that their product isn't a total turkey.

mtreis86 10y ago
How many people in the world have studied crypto? Radio and EE are both areas studied by a magnitude greater number of people at a serious level. Does crypto take a higher level of cognitive overhead to enter or do people only think it does? Is there a cryto structure similar to amateur radio?
- astrodust 10y ago
  It doesn't have to be crypto. Right now a basic check done by a post-grad student could probably catch 90% of the most glaring problems. Your dishwasher has an HTTP port open? That's not good. Your webcam uses port-popping UDP to open up a VPN to some random server in China? Yeah, we're not certifying that. We're talking about basic port mapping and monitoring of the device in operation to make sure the network activity observed has some reasonable correlation to the actions performed on the device. Most consumers don't have the tools to do this, nor the patience to perform these tests, but these tools are cheap and easy to use by anyone with the inclination. You can do additional fuzz testing quite easily, plus inspect the data stream for plain-text data that should be encrypted. If as part of the certification you needed to submit a document describing what encryption methods you use and what system you have in place for dealing with compromised keys and such, great, but I don't see that as strictly necessary. Considerable improvements to the marketplace can be made with very simple tests. This is the equivalent of plugging in an electrical device, observing it catches on fire, and giving it a failing grade. No specific knowledge of electronics is required.
Klathmon 10y ago
I could get behind an "FCC certification" style program for internet connected devices. I don't necessarily agree with a lot of the commenters saying it must have secure crypto, or that they need to be 100% liable for all issues down the road, but at least making sure the worst offences are covered, and there is a big database of these devices will go a long way to being able to do things like recalls, and holding the manufacturers responsible if there are major problems. Like you said, it's worked wonders with RF regulations. You don't ever see products that mess up and flood the RF spectrum with trash ruining everything else in the area, and I have a suspicion that's due to those certification processes.
- astrodust 10y ago
  It doesn't have to be a perfect process, or even one that's "feature complete" when it launches. It just needs to be something people can latch on to. Like if a previously certified device is found to be full of holes because of a new attack vector, that vendor can be forced to address that issue or lose their certification. Right now the consumers have no recourse other than an ugly class-action lawsuit.

mtreis86 10y ago

How many people in the world have studied crypto? Radio and EE are both areas studied by a magnitude greater number of people at a serious level. Does crypto take a higher level of cognitive overhead to enter or do people only think it does? Is there a cryto structure similar to amateur radio?

astrodust 10y ago
It doesn't have to be crypto. Right now a basic check done by a post-grad student could probably catch 90% of the most glaring problems. Your dishwasher has an HTTP port open? That's not good. Your webcam uses port-popping UDP to open up a VPN to some random server in China? Yeah, we're not certifying that. We're talking about basic port mapping and monitoring of the device in operation to make sure the network activity observed has some reasonable correlation to the actions performed on the device. Most consumers don't have the tools to do this, nor the patience to perform these tests, but these tools are cheap and easy to use by anyone with the inclination. You can do additional fuzz testing quite easily, plus inspect the data stream for plain-text data that should be encrypted. If as part of the certification you needed to submit a document describing what encryption methods you use and what system you have in place for dealing with compromised keys and such, great, but I don't see that as strictly necessary. Considerable improvements to the marketplace can be made with very simple tests. This is the equivalent of plugging in an electrical device, observing it catches on fire, and giving it a failing grade. No specific knowledge of electronics is required.

Klathmon 10y ago

I could get behind an "FCC certification" style program for internet connected devices. I don't necessarily agree with a lot of the commenters saying it must have secure crypto, or that they need to be 100% liable for all issues down the road, but at least making sure the worst offences are covered, and there is a big database of these devices will go a long way to being able to do things like recalls, and holding the manufacturers responsible if there are major problems. Like you said, it's worked wonders with RF regulations. You don't ever see products that mess up and flood the RF spectrum with trash ruining everything else in the area, and I have a suspicion that's due to those certification processes.

astrodust 10y ago
It doesn't have to be a perfect process, or even one that's "feature complete" when it launches. It just needs to be something people can latch on to. Like if a previously certified device is found to be full of holes because of a new attack vector, that vendor can be forced to address that issue or lose their certification. Right now the consumers have no recourse other than an ugly class-action lawsuit.