3 ms·

> If the lightbulb encrypts the password for storage, it necessarily also stores the decryption. An attacker would just have to take one extra step. Yeah, but

> If the lightbulb encrypts the password for storage, it necessarily also stores the decryption. An attacker would just have to take one extra step. Yeah, but they could use some kind of secure enclave to make it much more difficult. Like having the bulb query the enclave with a securely hashed version of each available SSID until the enclave returns a password. That would at least make it non-trivial to get the password or figure out what network it connects to without some prior knowledge. That's valuable since it would prevent someone from buying an old bulb then wardriving to find the network that it's credentials work for. Also it would be good to have some kind of secure reset physical button, to make it as easy as possible to clear any private data before the bulb is discarded. Neither of these ideas would help secure your network against exploitation of an actively-used bulb, but they'd help with the discarded-bulb case.

baddox 8y ago
I don’t get it. The bulb would have to be able to query the enclave, so the attacker can just have it do that and see what the enclave returns. The enclave in devices like iPhones are effective because they require external input (like a passcode or face/fingerprint scan). A lightbulb conveniently doesn’t require that every time it turns on.
- CharlesColeman 8y ago
  I edited my comment, but the idea was to increase the amount of foreknowledge required to extract something useful. It won't be perfect, but it's better than just storing the SSID/password in cleartext (or encrypted with an easily-extracted on-device key). The device wouldn't tell the attacker what he needed to know to find the network the password works for if he didn't already know it. Edit: another commenter linked https://wigle.net/ https://wigle.net/, which could make it extremely easy for an attacker to find the network to exploit if the device stores the SSID in cleartext. My idea would help make that a lot harder, especially if the enclave rate-limits requests.
- deleted 8y ago
  [deleted]
- behringer 8y ago
  It should be trivial to make the password write-only to the wifi electronics. For an attacker to get the wifi password, you'd have to remove the controller, and the controller could even be designed to mitigate against that attack too.

baddox 8y ago

I don’t get it. The bulb would have to be able to query the enclave, so the attacker can just have it do that and see what the enclave returns. The enclave in devices like iPhones are effective because they require external input (like a passcode or face/fingerprint scan). A lightbulb conveniently doesn’t require that every time it turns on.

CharlesColeman 8y ago
I edited my comment, but the idea was to increase the amount of foreknowledge required to extract something useful. It won't be perfect, but it's better than just storing the SSID/password in cleartext (or encrypted with an easily-extracted on-device key). The device wouldn't tell the attacker what he needed to know to find the network the password works for if he didn't already know it. Edit: another commenter linked https://wigle.net/ https://wigle.net/, which could make it extremely easy for an attacker to find the network to exploit if the device stores the SSID in cleartext. My idea would help make that a lot harder, especially if the enclave rate-limits requests.
deleted 8y ago
[deleted]
behringer 8y ago
It should be trivial to make the password write-only to the wifi electronics. For an attacker to get the wifi password, you'd have to remove the controller, and the controller could even be designed to mitigate against that attack too.