5 ms·

I don't think that government certification is the answer here. This will turn security into a check-mark. Companies will do the bare minimum to get certified a

I don't think that government certification is the answer here. This will turn security into a check-mark. Companies will do the bare minimum to get certified and won't invest a penny more. This would solve some of the more extreme cases we see, but I doubt it'll make a real impact. Instead, I feel that accountability would work much better here. If you're selling an IoT device, and you haven't taken industry standard precautions for securing it, then you're on the hook for whatever your device is used for. The same can be applies to companies storing personal information e.g. Equifax.

MBCook 9y ago
I think Schneier is right. The market has utterly failed here and there is no reason to think it will start working. Class action lawsuits are very slow and you have issues of trying to prove actual harm. To use his example if my TiVo is part of a botnet but continues working perfectly, have I been harmed in a way that’s likely to let me sue someone? What happens when you want to sue a company for lack of updates when the company went out of business 6mo after it was created (like Juciero)? You can’t sue them, where a law could have forced them to be secure from the start or put up a bond to support the devices for a while. Companies will do the bare minimum to get certified? You realize that’s a massive jump compared to what happens now.
- orblivion 9y ago
  Make consumers liable. They're really the guilty (by negligence) party anyway, right? Okay, that would be a shock to the system. So grandfather in old devices and/or slowly phase it in. That's still quite a chilling effect though. Well, maybe it should be. Now we're really careful about what we buy. But maybe it's too much. Who wants to expose themselves to a small chance of high liability? Okay, so allow insurance against said liability. Wouldn't that defeat the purpose? Well, no. Insurance companies would only insure against liability for devices they've vetted and approved. Boom, market regulation. It works for cars (see IIHS).
  - MBCook 9y ago
    I’m a software developer. I’ve worked for a network security company. I don’t think I’m qualified to try to do that for something I might buy, let alone ‘normal’ people. That’s one of the problems with the market approach. The information assymetry is so big that it’s not a reasonable demand on a person for a $15-20 lightbulb.
    - orblivion 9y ago
      To be clear, the only thing they'd need to do (in the ultimate phase) is only buy approved devices. Maybe a small hassle but not all that complicated.
- scoggs 9y ago
  From my POV all I can come up with that feels concrete is somehow trying to figure out a plan / system where we can ensure companies that should have a certain level of security can be held liable (no question) in a way that prevents things from being handled in a reactionary way. The problem I keep running into is that each and every scenario and company this type of system will effect will be a case-by-case basis. I can't brainstorm many simple solutions that blanket cover many different types of businesses, markets and scenarios.
- maltalex 9y ago
  You're right, and perhaps ideally we should have a mix of both accountability and certification. I don't know who could or would sue TiVo for the attack, and I don't know how to solve the problem of out of business companies. This approach has its drawbacks. However, give the certification process some thought too. I can see quite a few drawbacks here as well. First, a significant advantage for established, rich companies. We'll be swamped with IoT from Apple, Google, Facebook and Amazon while small competitors have a hard time getting their products to the market. Second, you'd need give the regulatory body access to both your software and your hardware. And what if the device is connected to some cloud server? That body may need to look at its code too to make sure that your control server is compliant. And what about the network? The database? Where does it end? And do you need to re-certify each and every version of your server? What if you introduce a security vulnerability? Third, certification can't be a one-time deal. That protocol your lightbulb uses to talk to the microwave oven for whatever reason? Well, someone broke that and can now make both of them divulge your dirtiest secrets. The same regulatory body would have to keep track of such vulnerabilities and force manufacturers to update their devices - and what if the manufacturer has gone bankrupt? What if he doesn't want to update these devices? Are you going to force people to throw away their light bulbs? You'll have to, otherwise you're back to square one in which all devices are compromised, only now it takes a little bit longer. Imagine the bureaucracy all of this will require.
  - MBCook 9y ago
    You’re right, it’s not easy. But even specifying hilariously trivial stuff like HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon. Simple security without even talking about the problems on the service servers. I imagine a market would appear for some of the basic software (Linux diaries, etc) to help make things easy for small companies that do want to do it all themselves. I like the government idea because frankly I can’t think of anything else that would work (outside a rediculously improbable change in consumer behavior).
    - maltalex 9y ago
      > HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon That's what I meant by check-mark security. Yes, it is better than nothing, and by all means let's do that. It's low hanging fruit, and it should be plucked. But in the end it amounts to little more than hanging an air re-freshener on a huge pile of garbage. I'm just pointing out that such certification might cause executives in companies that today put more effort into securing their devices to stop putting in that effort. If it's all the same to the consumer, why spend any more than the bare minimum to get a check mark? Today there's no clear bar, and a good engineering team will always be able to convince a responsible management that they need to put effort in security. But once that fairly low bar is set, I think that the next order from the management will be "make our devices certifiable and nothing more".

MBCook 9y ago

I think Schneier is right. The market has utterly failed here and there is no reason to think it will start working. Class action lawsuits are very slow and you have issues of trying to prove actual harm. To use his example if my TiVo is part of a botnet but continues working perfectly, have I been harmed in a way that’s likely to let me sue someone? What happens when you want to sue a company for lack of updates when the company went out of business 6mo after it was created (like Juciero)? You can’t sue them, where a law could have forced them to be secure from the start or put up a bond to support the devices for a while. Companies will do the bare minimum to get certified? You realize that’s a massive jump compared to what happens now.

orblivion 9y ago
Make consumers liable. They're really the guilty (by negligence) party anyway, right? Okay, that would be a shock to the system. So grandfather in old devices and/or slowly phase it in. That's still quite a chilling effect though. Well, maybe it should be. Now we're really careful about what we buy. But maybe it's too much. Who wants to expose themselves to a small chance of high liability? Okay, so allow insurance against said liability. Wouldn't that defeat the purpose? Well, no. Insurance companies would only insure against liability for devices they've vetted and approved. Boom, market regulation. It works for cars (see IIHS).
- MBCook 9y ago
  I’m a software developer. I’ve worked for a network security company. I don’t think I’m qualified to try to do that for something I might buy, let alone ‘normal’ people. That’s one of the problems with the market approach. The information assymetry is so big that it’s not a reasonable demand on a person for a $15-20 lightbulb.
  - orblivion 9y ago
    To be clear, the only thing they'd need to do (in the ultimate phase) is only buy approved devices. Maybe a small hassle but not all that complicated.
scoggs 9y ago
From my POV all I can come up with that feels concrete is somehow trying to figure out a plan / system where we can ensure companies that should have a certain level of security can be held liable (no question) in a way that prevents things from being handled in a reactionary way. The problem I keep running into is that each and every scenario and company this type of system will effect will be a case-by-case basis. I can't brainstorm many simple solutions that blanket cover many different types of businesses, markets and scenarios.
maltalex 9y ago
You're right, and perhaps ideally we should have a mix of both accountability and certification. I don't know who could or would sue TiVo for the attack, and I don't know how to solve the problem of out of business companies. This approach has its drawbacks. However, give the certification process some thought too. I can see quite a few drawbacks here as well. First, a significant advantage for established, rich companies. We'll be swamped with IoT from Apple, Google, Facebook and Amazon while small competitors have a hard time getting their products to the market. Second, you'd need give the regulatory body access to both your software and your hardware. And what if the device is connected to some cloud server? That body may need to look at its code too to make sure that your control server is compliant. And what about the network? The database? Where does it end? And do you need to re-certify each and every version of your server? What if you introduce a security vulnerability? Third, certification can't be a one-time deal. That protocol your lightbulb uses to talk to the microwave oven for whatever reason? Well, someone broke that and can now make both of them divulge your dirtiest secrets. The same regulatory body would have to keep track of such vulnerabilities and force manufacturers to update their devices - and what if the manufacturer has gone bankrupt? What if he doesn't want to update these devices? Are you going to force people to throw away their light bulbs? You'll have to, otherwise you're back to square one in which all devices are compromised, only now it takes a little bit longer. Imagine the bureaucracy all of this will require.
- MBCook 9y ago
  You’re right, it’s not easy. But even specifying hilariously trivial stuff like HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon. Simple security without even talking about the problems on the service servers. I imagine a market would appear for some of the basic software (Linux diaries, etc) to help make things easy for small companies that do want to do it all themselves. I like the government idea because frankly I can’t think of anything else that would work (outside a rediculously improbable change in consumer behavior).
  - maltalex 9y ago
    > HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon That's what I meant by check-mark security. Yes, it is better than nothing, and by all means let's do that. It's low hanging fruit, and it should be plucked. But in the end it amounts to little more than hanging an air re-freshener on a huge pile of garbage. I'm just pointing out that such certification might cause executives in companies that today put more effort into securing their devices to stop putting in that effort. If it's all the same to the consumer, why spend any more than the bare minimum to get a check mark? Today there's no clear bar, and a good engineering team will always be able to convince a responsible management that they need to put effort in security. But once that fairly low bar is set, I think that the next order from the management will be "make our devices certifiable and nothing more".