5 ms·

You're right, and perhaps ideally we should have a mix of both accountability and certification. I don't know who could or would sue TiVo for the attack, and I

You're right, and perhaps ideally we should have a mix of both accountability and certification. I don't know who could or would sue TiVo for the attack, and I don't know how to solve the problem of out of business companies. This approach has its drawbacks. However, give the certification process some thought too. I can see quite a few drawbacks here as well. First, a significant advantage for established, rich companies. We'll be swamped with IoT from Apple, Google, Facebook and Amazon while small competitors have a hard time getting their products to the market. Second, you'd need give the regulatory body access to both your software and your hardware. And what if the device is connected to some cloud server? That body may need to look at its code too to make sure that your control server is compliant. And what about the network? The database? Where does it end? And do you need to re-certify each and every version of your server? What if you introduce a security vulnerability? Third, certification can't be a one-time deal. That protocol your lightbulb uses to talk to the microwave oven for whatever reason? Well, someone broke that and can now make both of them divulge your dirtiest secrets. The same regulatory body would have to keep track of such vulnerabilities and force manufacturers to update their devices - and what if the manufacturer has gone bankrupt? What if he doesn't want to update these devices? Are you going to force people to throw away their light bulbs? You'll have to, otherwise you're back to square one in which all devices are compromised, only now it takes a little bit longer. Imagine the bureaucracy all of this will require.

MBCook 9y ago
You’re right, it’s not easy. But even specifying hilariously trivial stuff like HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon. Simple security without even talking about the problems on the service servers. I imagine a market would appear for some of the basic software (Linux diaries, etc) to help make things easy for small companies that do want to do it all themselves. I like the government idea because frankly I can’t think of anything else that would work (outside a rediculously improbable change in consumer behavior).
- maltalex 9y ago
  > HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon That's what I meant by check-mark security. Yes, it is better than nothing, and by all means let's do that. It's low hanging fruit, and it should be plucked. But in the end it amounts to little more than hanging an air re-freshener on a huge pile of garbage. I'm just pointing out that such certification might cause executives in companies that today put more effort into securing their devices to stop putting in that effort. If it's all the same to the consumer, why spend any more than the bare minimum to get a check mark? Today there's no clear bar, and a good engineering team will always be able to convince a responsible management that they need to put effort in security. But once that fairly low bar is set, I think that the next order from the management will be "make our devices certifiable and nothing more".
  - MBCook 9y ago
    Just like car safety we have to keep raising the bar. Checklist car safety means a pretty safe car these days, and the companies that go beyond do amazing things.
- collinmanderson 9y ago
  > I like the government idea because frankly I can’t think of anything else that would work (outside a rediculously improbable change in consumer behavior). I'm surprised PCI (payment card industry) security standards have not been mentioned on this thread. There's a case where non-government regulation has, by some definition, worked. PCI isn't perfect: if you check all of the boxes, it doesn't mean you're secure, but I'd rather have the industry self-regulate than have politics come into play.

MBCook 9y ago

You’re right, it’s not easy. But even specifying hilariously trivial stuff like HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon. Simple security without even talking about the problems on the service servers. I imagine a market would appear for some of the basic software (Linux diaries, etc) to help make things easy for small companies that do want to do it all themselves. I like the government idea because frankly I can’t think of anything else that would work (outside a rediculously improbable change in consumer behavior).

maltalex 9y ago
> HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon That's what I meant by check-mark security. Yes, it is better than nothing, and by all means let's do that. It's low hanging fruit, and it should be plucked. But in the end it amounts to little more than hanging an air re-freshener on a huge pile of garbage. I'm just pointing out that such certification might cause executives in companies that today put more effort into securing their devices to stop putting in that effort. If it's all the same to the consumer, why spend any more than the bare minimum to get a check mark? Today there's no clear bar, and a good engineering team will always be able to convince a responsible management that they need to put effort in security. But once that fairly low bar is set, I think that the next order from the management will be "make our devices certifiable and nothing more".
- MBCook 9y ago
  Just like car safety we have to keep raising the bar. Checklist car safety means a pretty safe car these days, and the companies that go beyond do amazing things.
collinmanderson 9y ago
> I like the government idea because frankly I can’t think of anything else that would work (outside a rediculously improbable change in consumer behavior). I'm surprised PCI (payment card industry) security standards have not been mentioned on this thread. There's a case where non-government regulation has, by some definition, worked. PCI isn't perfect: if you check all of the boxes, it doesn't mean you're secure, but I'd rather have the industry self-regulate than have politics come into play.