3 ms·

China already ignores safety and radio regulations. Sure, add more. They'll keep flooding Amazon and eBay with cheap crap and people will keep buying it. Good I

China already ignores safety and radio regulations. Sure, add more. They'll keep flooding Amazon and eBay with cheap crap and people will keep buying it. Good IoT will just become even more expensive. The only way to avoid a botnet apocalypse is to secure home routers. Outbound traffic should not be an automatic right. People should have to authorise each device for each type of traffic. I argued this long-hand when OVH was taken down by "security" cameras. Good to see we've made no progress. https://thepcspy.com/read/when-did-we-stop-caring-network-security/ https://thepcspy.com/read/when-did-we-stop-caring-network-se...

JumpCrisscross 9y ago
> People should have to authorise each device for each type of traffic Nobody wants to do this. I'm a quarter way paranoid about electronic security and even I don't want to do this.
- oliwarner 9y ago
  Sure. I've been through this though. See the link. I recommend a certification programme, with manufacturers justifying the access their device needs. A little signed JSON blob of hosts and ports it plans on connecting to. The device communicates this to the router. If the signing certificate is still valid and the manufacturer trusted, the router could just allow that access, or prompt the user to just let them know that device is trying to connect. No confusing detail. And just once, at the same time you're setting up network stuff, so it's not weird or extra hassle. It's leaps and bounds better than what we currently have. The vast majority of us have zero idea what the devices on our network are actually doing, all while we're each throwing dozens of these cheap internet-enabled things online. For legacy devices, a more iterative approach might be needed but it can still be prompted: "Dell computer is trying to connect to clearlybaddomain-dot-com. Allow, Allow All, Deny, Quarantine". You could even layer on some "known bad" hosts or traffic patterns via centralised lists to automatically quarantine devices at the router level. Nothing here is rocket surgery. One developer for a few months. An entity like Google could do this in an afternoon. There's just surprisingly little appetite for it.
stordoff 9y ago
> People should have to authorise each device for each type of traffic. Seems somewhat unreasonable to expect people to know what traffic a device needs, and if you ask too much, people will just default to allowing it without even thinking about it (I still occasionally see people suggesting using a DMZ to make online games work, rather than forwarding the necessary ports [and even that seems rarely required]).
- oliwarner 9y ago
  See link or my other reply for implementation detail. This can be both very secure and simple.

JumpCrisscross 9y ago

> People should have to authorise each device for each type of traffic Nobody wants to do this. I'm a quarter way paranoid about electronic security and even I don't want to do this.

oliwarner 9y ago
Sure. I've been through this though. See the link. I recommend a certification programme, with manufacturers justifying the access their device needs. A little signed JSON blob of hosts and ports it plans on connecting to. The device communicates this to the router. If the signing certificate is still valid and the manufacturer trusted, the router could just allow that access, or prompt the user to just let them know that device is trying to connect. No confusing detail. And just once, at the same time you're setting up network stuff, so it's not weird or extra hassle. It's leaps and bounds better than what we currently have. The vast majority of us have zero idea what the devices on our network are actually doing, all while we're each throwing dozens of these cheap internet-enabled things online. For legacy devices, a more iterative approach might be needed but it can still be prompted: "Dell computer is trying to connect to clearlybaddomain-dot-com. Allow, Allow All, Deny, Quarantine". You could even layer on some "known bad" hosts or traffic patterns via centralised lists to automatically quarantine devices at the router level. Nothing here is rocket surgery. One developer for a few months. An entity like Google could do this in an afternoon. There's just surprisingly little appetite for it.

stordoff 9y ago

> People should have to authorise each device for each type of traffic. Seems somewhat unreasonable to expect people to know what traffic a device needs, and if you ask too much, people will just default to allowing it without even thinking about it (I still occasionally see people suggesting using a DMZ to make online games work, rather than forwarding the necessary ports [and even that seems rarely required]).

oliwarner 9y ago
See link or my other reply for implementation detail. This can be both very secure and simple.