4 ms·

We are not "unable" to protect smart TVs. If anyone gave a shit those things would be locked down tighter than a bank vault, but we don't, so they aren't. But

by lodi 9y ago

We are not "unable" to protect smart TVs. If anyone gave a shit those things would be locked down tighter than a bank vault, but we don't, so they aren't. But, as evidenced by terrorism paranoia, people do care about their personal safety--perhaps excessively and irrationally so. Security in a networked self-driving car won't be treated as an afterthought, if nothing else because of the massive legal liability.

pkolaczk 9y ago
I seriously doubt this. People do care if their car gets stolen. Unfortunately most (if not all) built-in electronic systems for protecting modern cars from being stolen are crap and thieves somehow get around them. Many of these systems (e.g. Keeloq) used "roll your own" insecure cryptography based on security by obscurity, despite availability of much stronger algorithms at that time.
eslaught 9y ago
> We are not "unable" to protect smart TVs. If anyone gave a shit those things would be locked down tighter than a bank vault, but we don't, so they aren't. Every year, every major browser and major OS gets cracked in Pwn2Own. The cost of these zero-days is going up thanks to good security practices like sandboxing in Chrome et al., but they still happen. Every. Single. Year. Think about that for a second. The fact is, we can't write secure software, especially secure networked software. I can't imagine writing secure software for cars using current best practices---let alone imagine car manufacturers doing that. To solve this, we'll need (in addition to everything we're doing now) something along the lines of Rust to prevent these sorts of bugs. And even then, it's likely that the net effect will be similar to sandboxing: the cost of an attack will go up, but not enough to prevent random individuals (let alone larger organizations) from finding zero-day security vulnerabilities on a regular basis. It's extremely important not to be cavalier about this security risk. The combination of zero-days and self-driving cars is a scary one.

by lodi 9y ago

pkolaczk 9y ago

I seriously doubt this. People do care if their car gets stolen. Unfortunately most (if not all) built-in electronic systems for protecting modern cars from being stolen are crap and thieves somehow get around them. Many of these systems (e.g. Keeloq) used "roll your own" insecure cryptography based on security by obscurity, despite availability of much stronger algorithms at that time.

eslaught 9y ago

> We are not "unable" to protect smart TVs. If anyone gave a shit those things would be locked down tighter than a bank vault, but we don't, so they aren't. Every year, every major browser and major OS gets cracked in Pwn2Own. The cost of these zero-days is going up thanks to good security practices like sandboxing in Chrome et al., but they still happen. Every. Single. Year. Think about that for a second. The fact is, we can't write secure software, especially secure networked software. I can't imagine writing secure software for cars using current best practices---let alone imagine car manufacturers doing that. To solve this, we'll need (in addition to everything we're doing now) something along the lines of Rust to prevent these sorts of bugs. And even then, it's likely that the net effect will be similar to sandboxing: the cost of an attack will go up, but not enough to prevent random individuals (let alone larger organizations) from finding zero-day security vulnerabilities on a regular basis. It's extremely important not to be cavalier about this security risk. The combination of zero-days and self-driving cars is a scary one.