4 ms·

> Don't think for a second that I'm saying anyone should get a pass, they shouldn't, but this to me seems like the equivalent of reviewing $3 luggage locks and

> Don't think for a second that I'm saying anyone should get a pass, they shouldn't, but this to me seems like the equivalent of reviewing $3 luggage locks and talking about how insecure they are, then concluding that all locks are insecure and you shouldn't use them... No, the article shows that $3 luggage locks exist, and then provides sound general advice on how to avoid those.

supergeek133 9y ago
"IoT hack: how to break a smart home… again" This is not a reasonable headline if you believe that is all the article is trying to get across.
- ckastner 9y ago
  It may be a bit ambiguous, but a reasonable interpretation exists (it's about a home, not all homes). Regardless, the headline may be poorly chosen, but the interpretation "the entire ecosystem is that bad" is not supported by the article. Lastly, what's the point discussing luggage security when we can't talk about the $3 luggage locks? How else are we supposed to get rid of them?
Klathmon 9y ago
Except their advice wouldn't even stop the attacks they outlined. > Always change the default password. Instead use a strict and complex one. Don’t forget to update it regularly. Good advice, but it won't stop the password from being sent over HTTP. > Don’t share serial numbers, IP addresses and other sensitive information regarding your smart devices on social networks Again, good advice, but it won't stop the device from storing WiFi credentials after a hard reset. > Be aware and always check the latest information on discovered IoT vulnerabilities. I wish I could, but they haven't named a single device that anyone can watch out for, nor have they shared any way that the average user can check for these vulnerabilities.
- ckastner 9y ago
  Those three points are explicitly meant to be "for users". Your counterarguments address implementation issues, but the advice given to implementors is consistent with your arguments: "No less important is that vendors should improve and enhance their security approach to ensure their devices are adequately protected and, as a result, their users [...]"
  - Klathmon 9y ago
    >Those three points are explicitly meant to be "for users". But my point is that their article explicitly shows that those 3 points are pointless for users. A user's only defense against the attacks show in the article is to not buy or stop using those devices. And until security researchers are willing to let users know if their devices are insecure, it's only going to get worse. It's strangely analogous to "abstinence" as a form of birth control. Telling people who want IoT devices to just not use them isn't a valid answer. Show them good examples of well designed devices, point out the worst offenders by name and explicitly, and show what users can do to research and avoid devices like them. Talking about how your serial might be used as a form of authentication, and to keep up to date on IoT vulnerabilities that they themself won't publish doesn't do anyone any good.
    - ckastner 9y ago
      > But my point is that their article explicitly shows that those 3 points are pointless for users. It's pointless with that device. The 3 points are general advice, and changing a default password, for example, is definitely sound advice. > Telling people who want IoT devices to just not use them isn't a valid answer Where are you getting this from? There's an entire section in the article ("Get Ready") with suggestions on how to securely use IoT devices. There's no mention of not using them. > and show what users can do to research and avoid devices like them. That is the entire point of the article.

supergeek133 9y ago

"IoT hack: how to break a smart home… again" This is not a reasonable headline if you believe that is all the article is trying to get across.

ckastner 9y ago
It may be a bit ambiguous, but a reasonable interpretation exists (it's about a home, not all homes). Regardless, the headline may be poorly chosen, but the interpretation "the entire ecosystem is that bad" is not supported by the article. Lastly, what's the point discussing luggage security when we can't talk about the $3 luggage locks? How else are we supposed to get rid of them?

Klathmon 9y ago

Except their advice wouldn't even stop the attacks they outlined. > Always change the default password. Instead use a strict and complex one. Don’t forget to update it regularly. Good advice, but it won't stop the password from being sent over HTTP. > Don’t share serial numbers, IP addresses and other sensitive information regarding your smart devices on social networks Again, good advice, but it won't stop the device from storing WiFi credentials after a hard reset. > Be aware and always check the latest information on discovered IoT vulnerabilities. I wish I could, but they haven't named a single device that anyone can watch out for, nor have they shared any way that the average user can check for these vulnerabilities.

ckastner 9y ago
Those three points are explicitly meant to be "for users". Your counterarguments address implementation issues, but the advice given to implementors is consistent with your arguments: "No less important is that vendors should improve and enhance their security approach to ensure their devices are adequately protected and, as a result, their users [...]"
- Klathmon 9y ago
  >Those three points are explicitly meant to be "for users". But my point is that their article explicitly shows that those 3 points are pointless for users. A user's only defense against the attacks show in the article is to not buy or stop using those devices. And until security researchers are willing to let users know if their devices are insecure, it's only going to get worse. It's strangely analogous to "abstinence" as a form of birth control. Telling people who want IoT devices to just not use them isn't a valid answer. Show them good examples of well designed devices, point out the worst offenders by name and explicitly, and show what users can do to research and avoid devices like them. Talking about how your serial might be used as a form of authentication, and to keep up to date on IoT vulnerabilities that they themself won't publish doesn't do anyone any good.
  - ckastner 9y ago
    > But my point is that their article explicitly shows that those 3 points are pointless for users. It's pointless with that device. The 3 points are general advice, and changing a default password, for example, is definitely sound advice. > Telling people who want IoT devices to just not use them isn't a valid answer Where are you getting this from? There's an entire section in the article ("Get Ready") with suggestions on how to securely use IoT devices. There's no mention of not using them. > and show what users can do to research and avoid devices like them. That is the entire point of the article.