4 ms·

Did anyone expect more from these devices? It like expecting privacy from virtual assistants.

fwip 8y ago
Forgive me if I'm being naive, but what's the alternative to storing the wifi password? If the lightbulb encrypts the password for storage, it necessarily also stores the decryption. An attacker would just have to take one extra step. I guess what I'm saying is, doesn't this apply to any device you save any password in? (And don't need a password to log in on reboot). Edit: Thanks for all the info in the replies!
- CharlesColeman 8y ago
  > If the lightbulb encrypts the password for storage, it necessarily also stores the decryption. An attacker would just have to take one extra step. Yeah, but they could use some kind of secure enclave to make it much more difficult. Like having the bulb query the enclave with a securely hashed version of each available SSID until the enclave returns a password. That would at least make it non-trivial to get the password or figure out what network it connects to without some prior knowledge. That's valuable since it would prevent someone from buying an old bulb then wardriving to find the network that it's credentials work for. Also it would be good to have some kind of secure reset physical button, to make it as easy as possible to clear any private data before the bulb is discarded. Neither of these ideas would help secure your network against exploitation of an actively-used bulb, but they'd help with the discarded-bulb case.
  - baddox 8y ago
    I don’t get it. The bulb would have to be able to query the enclave, so the attacker can just have it do that and see what the enclave returns. The enclave in devices like iPhones are effective because they require external input (like a passcode or face/fingerprint scan). A lightbulb conveniently doesn’t require that every time it turns on.
    - CharlesColeman 8y ago
      I edited my comment, but the idea was to increase the amount of foreknowledge required to extract something useful. It won't be perfect, but it's better than just storing the SSID/password in cleartext (or encrypted with an easily-extracted on-device key). The device wouldn't tell the attacker what he needed to know to find the network the password works for if he didn't already know it. Edit: another commenter linked https://wigle.net/ https://wigle.net/, which could make it extremely easy for an attacker to find the network to exploit if the device stores the SSID in cleartext. My idea would help make that a lot harder, especially if the enclave rate-limits requests.
    - deleted 8y ago
      [deleted]
    - behringer 8y ago
      It should be trivial to make the password write-only to the wifi electronics. For an attacker to get the wifi password, you'd have to remove the controller, and the controller could even be designed to mitigate against that attack too.
- thefounder 8y ago
  I belive it could use a separate/isolated chip/secure enclave to handle the wifi connection(inclusing password storage).
- tremon 8y ago
  If they can't manage to store this securely, perhaps the bulbs should not be sold?
- baddox 8y ago
  I can’t think of a great way to protect the WiFi password on smart bulbs that wouldn’t potentially be inconvenient or even dangerous. Perhaps you could have the smart hub store the encrypted WiFi password, and require a manual unlock every time it cycles power. This would require something like a Bluetooth connection from your phone (since you obviously won’t have WiFi). This would obviously be very inconvenient, and potentially dangerous in some situation where you need your home lighting. Perhaps the emergency situation can be solved by having smart bulbs turn on maximum brightness after cycling power (which I believe the Philips Hue bulbs do).
  - antsar 8y ago
    How about using RADIUS auth with unique credentials for each device? You still have to revoke old credentials, but this is much more reasonable than rotating the shared key on every device every time you throw away a bulb.
- jsight 8y ago
  They could use a secure enclave. But just as suggested here, it would only add a marginal amount of security and at a non-zero added cost. I'd rather just delete the password. Or better yet, skip the wifi bulb and use something like Z-Wave or Zigbee.
- antsar 8y ago
  One option is to use per-device WiFi credentials (i.e. RADIUS auth). You still need to invalidate the credentials when you throw away a bulb, but there are advantages: 1. Unlike "wipe the bulb before discarding", you don't have to trust the bulb manufacturer to actually wipe. 2. You can invalidate credentials even after discarding a bulb.
- orthecreedence 8y ago
  > what's the alternative to storing the wifi password? Don't store the wifi at all. It's a light bulb. It burns out. Store the wifi password in the socket/switch. That is the solution.
  - antsar 8y ago
    And create a protocol for the socket/switch to tell the bulb what color & brightness to glow?
- petschge 8y ago
  Instead of going for complicated software solutions one could just include a physical button in the base that break the flash memory chip. Before you discard the bulb you press the button and keep your secrets. The better solution of course would be to have the intelligence in the socket/switch/wiring. But that requires more effort when upgrading to "smart" (they are not smart, you still have to manually set them to the desired mode.) illumination and doesn't play nice with rental property.
  - UncleEntity 8y ago
    > Instead of going for complicated software solutions one could just include a physical button in the base that break the flash memory chip. Or a sledgehammer... We need a new internet law: Never provide a technical solution to a problem which can reasonably solved with a hammer.
    - fwip 8y ago
      Does a sledgehammer increase the amount of e-waste and make recycling it / safely disposing of it harder?

fwip 8y ago

Forgive me if I'm being naive, but what's the alternative to storing the wifi password? If the lightbulb encrypts the password for storage, it necessarily also stores the decryption. An attacker would just have to take one extra step. I guess what I'm saying is, doesn't this apply to any device you save any password in? (And don't need a password to log in on reboot). Edit: Thanks for all the info in the replies!

CharlesColeman 8y ago
> If the lightbulb encrypts the password for storage, it necessarily also stores the decryption. An attacker would just have to take one extra step. Yeah, but they could use some kind of secure enclave to make it much more difficult. Like having the bulb query the enclave with a securely hashed version of each available SSID until the enclave returns a password. That would at least make it non-trivial to get the password or figure out what network it connects to without some prior knowledge. That's valuable since it would prevent someone from buying an old bulb then wardriving to find the network that it's credentials work for. Also it would be good to have some kind of secure reset physical button, to make it as easy as possible to clear any private data before the bulb is discarded. Neither of these ideas would help secure your network against exploitation of an actively-used bulb, but they'd help with the discarded-bulb case.
- baddox 8y ago
  I don’t get it. The bulb would have to be able to query the enclave, so the attacker can just have it do that and see what the enclave returns. The enclave in devices like iPhones are effective because they require external input (like a passcode or face/fingerprint scan). A lightbulb conveniently doesn’t require that every time it turns on.
  - CharlesColeman 8y ago
    I edited my comment, but the idea was to increase the amount of foreknowledge required to extract something useful. It won't be perfect, but it's better than just storing the SSID/password in cleartext (or encrypted with an easily-extracted on-device key). The device wouldn't tell the attacker what he needed to know to find the network the password works for if he didn't already know it. Edit: another commenter linked https://wigle.net/ https://wigle.net/, which could make it extremely easy for an attacker to find the network to exploit if the device stores the SSID in cleartext. My idea would help make that a lot harder, especially if the enclave rate-limits requests.
  - deleted 8y ago
    [deleted]
  - behringer 8y ago
    It should be trivial to make the password write-only to the wifi electronics. For an attacker to get the wifi password, you'd have to remove the controller, and the controller could even be designed to mitigate against that attack too.
thefounder 8y ago
I belive it could use a separate/isolated chip/secure enclave to handle the wifi connection(inclusing password storage).
tremon 8y ago
If they can't manage to store this securely, perhaps the bulbs should not be sold?
baddox 8y ago
I can’t think of a great way to protect the WiFi password on smart bulbs that wouldn’t potentially be inconvenient or even dangerous. Perhaps you could have the smart hub store the encrypted WiFi password, and require a manual unlock every time it cycles power. This would require something like a Bluetooth connection from your phone (since you obviously won’t have WiFi). This would obviously be very inconvenient, and potentially dangerous in some situation where you need your home lighting. Perhaps the emergency situation can be solved by having smart bulbs turn on maximum brightness after cycling power (which I believe the Philips Hue bulbs do).
- antsar 8y ago
  How about using RADIUS auth with unique credentials for each device? You still have to revoke old credentials, but this is much more reasonable than rotating the shared key on every device every time you throw away a bulb.
jsight 8y ago
They could use a secure enclave. But just as suggested here, it would only add a marginal amount of security and at a non-zero added cost. I'd rather just delete the password. Or better yet, skip the wifi bulb and use something like Z-Wave or Zigbee.
antsar 8y ago
One option is to use per-device WiFi credentials (i.e. RADIUS auth). You still need to invalidate the credentials when you throw away a bulb, but there are advantages: 1. Unlike "wipe the bulb before discarding", you don't have to trust the bulb manufacturer to actually wipe. 2. You can invalidate credentials even after discarding a bulb.
orthecreedence 8y ago
> what's the alternative to storing the wifi password? Don't store the wifi at all. It's a light bulb. It burns out. Store the wifi password in the socket/switch. That is the solution.
- antsar 8y ago
  And create a protocol for the socket/switch to tell the bulb what color & brightness to glow?
petschge 8y ago
Instead of going for complicated software solutions one could just include a physical button in the base that break the flash memory chip. Before you discard the bulb you press the button and keep your secrets. The better solution of course would be to have the intelligence in the socket/switch/wiring. But that requires more effort when upgrading to "smart" (they are not smart, you still have to manually set them to the desired mode.) illumination and doesn't play nice with rental property.
- UncleEntity 8y ago
  > Instead of going for complicated software solutions one could just include a physical button in the base that break the flash memory chip. Or a sledgehammer... We need a new internet law: Never provide a technical solution to a problem which can reasonably solved with a hammer.
  - fwip 8y ago
    Does a sledgehammer increase the amount of e-waste and make recycling it / safely disposing of it harder?