13 ms·

Bluetooth's Complexity Has Become a Security Risk

229 points by Elof 7y ago

peter_retief 7y ago
I am using thread which is a lot more sensible https://openthread.io/ https://openthread.io/
brownbat 7y ago
It'd be nice if we at least got the easy connectivity promised and just had to work out a few security kinks. https://xkcd.com/2055/ https://xkcd.com/2055/ I have a few Bluetooth speakers. If I accidentally close the app but forget to disconnect from settings too, then no one else can pair with them until I return. This seems like standard behavior, and makes me worry that if I lose my phone at the wrong moment, I might brick a few devices. I really like common standards, but if the consortium can't fix either security or usability, we might be better off with a clean slate.
- throwaway2048 7y ago
  A clean slate that repeats all the same mistakes in 10 years, but at least we will have a $clean_slate+1 and really get it right this time.
- crehn 7y ago
  Lately Bluetooth connectivity with Apple devices has been great for me. AirPods just work and everything is pretty snappy and stable.
  - baby 7y ago
    Yet there is still quite a lot of friction. Airpods have the best support and they still require you to find out how to pair them when you change device and wait. Keyboard/mouse is insane. If you want to use them with two different laptops.
    - visarga 7y ago
      When I connect my AirPods to my 2015 MBP they don't properly connect unless I open and hover over the speaker icon in the system bar. There's also an issue if I start connection with only the left bud, probably the right bud is the main one?
      - arebours 7y ago
        > There's also an issue if I start connection with only the left bud, probably the right bud is the main one? I think they are symmetrical. You can use both separately, without the other.
    - wongarsu 7y ago
      My mouse (Logitech MX Master) supports Bluetooth. It also supports Logitech' s "Unifying Receiver" and has a button to switch between three different Logitech receivers. I think everyone can guess correctly which of these options just works and always does what you want it to.
      - frosted-flakes 7y ago
        If it's not obvious, the USB receiver works flawlessly. I occasionally have trouble with Bluetooth not connecting (or randomly disconnecting) with the same mouse, but it mostly works okay.
      - omegabravo 7y ago
        To clarify if it's not clear - the button switches between three different receivers, Bluetooth or Logitech unifying receivers. Currently I have 2 BT profiles, and 1 Logitech. The mouse works flawlessly
- thrower123 7y ago
  I've gotten bluetooth to work a handful of times. I've not been able to repeat that feat enough times to figure out why it works when it works and doesn't work when it doesn't, so I just throw my hands up and stick to aux and USB wired connections.
- a012 7y ago
  I bought a Bluetooth speaker and only Apple devices can use it smoothly, my Android 8/9 phone remembers its paired speaker but can't connect it unless I unpair them, press speaker's pair button, pair my phone again every single times. I plan to buy a DAC that support Spotify connect.
- Swizec 7y ago
  My favorite part is when headphones connect to the laptop in my backpack that’s closed and the laptop I’m currently using. They play music successfully but volume is set to 0 because I guess macOS does that in sleep mode. So I have to open up the sleeping laptop just to disconnect bluetooth
s_m_t 7y ago
In my opinion part of the problem with Bluetooth is that the API exposed by android and IOS is like... two or three layers too low. Imagine if in web programming you set the MTU size in your HTML and you get the idea of what programming Bluetooth is like. Another issue I see is more of a view point that people have trouble shaking. Typically we think of the server as being more powerful than the client, but in BLE the client usually has more processing power and battery by several orders of magnitude. Once you examine this preconception BLE makes a whole lot more sense.
- fopen64 7y ago
  You mean the BLE API? In classic Bluetooth the main problem was the lack of APIs, only SPP is supported (and not even that, in iOS). Bluetooth is really a good bad example of committee design.
  - gHosts 7y ago
    Wellllll, HCI is your API as far as bluetooth.org is concerned...
- sratner 7y ago
  It isn't even the API vendors' fault necessarily. Compared to HTTP/TCP/IP, abstractions between layers of the BLE stack are extremely leaky. Examples: indicating choice of PHY coding and channels in the equivalent of a `listen/connect` call, or the three different but intertwined places where fragmentation/reassembly can happen. Being effective with BLE requires deep understanding of the entire stack, and since it is difficult for a single person to have such level of understanding, we get bugs. By comparison, being effective with HTTP does not require one to know anything about the PHY layer, or TCP stream reassembly. I suspect this is due to not having enough independent implementations of each layer - Bluetooth is designed and standardized by one committee, and the entire stack usually implemented as a single "thing", making it too easy to break abstraction when a new feature needs to be added.
  - arcticbull 7y ago
ikeboy 7y ago
How come we can't solve lag? There should be a part of the protocol that determines the lag and a standard way for programs to then set their delay accordingly, so that when I'm watching a video the sound is synced with the screen. Instead I have to manually try several different lag times until one feels good enough.
- aantthony 7y ago
  It seems the AirPods do this. It will delay the video so that it’s in sync. It might already be in the protocol.
  - ikeboy 7y ago
    I know that VLC on Android needs the audio sync delay to be set manually, and VLC is usually great about implementing features when possible so I assumed it wasn't part of the protocol.
- jjcm 7y ago
  It seems like something endemic to the protocol. Logitech's recent wireless mice/keyboards have skipped bluetooth altogether - they determined the lag was simply too large for high performance gaming: https://www.reddit.com/r/MouseReview/comments/99qq4a/about_that_1ms_lightspeed_wireless_technology/ https://www.reddit.com/r/MouseReview/comments/99qq4a/about_t...
  - MrBuddyCasino 7y ago
    I have a Logitech G603 mouse that supports both, and there is no noticeable lag when using the proprietary dongle. I'm still glad BT is supported as a fallback, but the lag is undeniable.
gHosts 7y ago
Become? Become!? That's funny. That's Rich. Do you have any idea how bloody insanely complex bluetooth is? Just the the core stuff, https://www.bluetooth.com/specifications/bluetooth-core-specification/ https://www.bluetooth.com/specifications/bluetooth-core-spec... without the various protocol specs... https://www.bluetooth.com/specifications/protocol-specifications/ https://www.bluetooth.com/specifications/protocol-specificat... or the GATT or ... The bloody core spec is 3000 PAGES of standardese. All in stuff that costs less than a dollar per chip.
- techslave 7y ago
  what’s is your point about it being a dollar per chip? that it’s implemented by super cheap labor or something? silicon is free. you are paying for the r&d. that’s why volume matters. at the volume of bluetooth chips, they are almost indeed free. most of that dollar is distribution costs. my point is, the cost of the chip isn’t a signal of anything except the ubiquity of it.
  - gHosts 7y ago
    True. The likes of broadcom are hugely sophisticated and really really understand the spec. But _none_ of your consumer level gadgets are made by broadcom. Broadcom will sell millions of these cheap as chips chips to second tier players. Who may sell on to third tier players. Who buy or pull a bluetooth stack and sort of vaguely maybe know what they doing, tie it all together and get the BT compliance stamp (which sort of means it doesn't shit all over the RF spectrum and vaguely works)... ...and then the sell it to you. ie. The chip manufacturer hopefully has clue.... then it gallops rapidly downhill from there.
    - Paul_S 7y ago
      All Bluetooth chips come with SDKs and depending on your solution another API in the OS of your board. At that point clients don't need to know much about bt and from my experience don't care beyond "how do I make these bytes appear on the other side". BT is massive but that's mostly BT classic which is slowly going away as more and more chips are BLE only which is saner. That's why we're adding isochronous channels to keep it interesting.
baby 7y ago
The funny thing is that the protocol is meant to be run by tiny devices. So of course one would thing they would have attempted to make it simple.
- Paul_S 7y ago
  If you want simple you can build your own on top of 15.4. This way your device will work but only with your other device. The big thing about BT is that it's everywhere.
  - kkarakk 7y ago
    The top players (apple/samsung) have switched to proprietary stacks on top of bluetooth to get the "magic" pairing experience. Google is following suite soon. On non "magic" pairing devices, bt is still a pain in the ass to get to work comparatively. Imagine if you had to do the standard bt pairing process for wifi. Device to connect to has to be broadcasting, Device trying to connect has to be listening, after connection you have to ensure that the passcodes are the same etc etc. If the connection drops then repeat the process sometimes(<BT 5.0).
gtirloni 7y ago
What happened to UWB as an alternative for Wireless PAN? I remember it being proposed as an alternative. Is it any easier to use/secure? The high frequencies should work fine for short ranges, no?
Paul_S 7y ago
The problem with BT is not unique to BT. Any protocol at the time when it's used by app developers is not understood and misused. Most products in the wild just use the example code provided in the sdks provided. You can make a whole product this way. Especially simple stuff like bt speakers.
ahartmetz 7y ago
The problems with Bluetooth are it doesn't pair, it doesn't unpair, you need to unpair first, you need to use the other protocol that transmits audio, the latency is way too high, it's insecure, the software stack hangs or crashes, you can't know for sure if two devices will work together, BLE is WAY too low level and a step back, the spec is way too big and complicated, ... In 20 years they have not managed to make it good. It seems hopeless with the current institutions managing it. What a heap of hot garbage.
- B-Con 7y ago
  And they wonder why there's resistance to phones that are wireless only. Their wireless audio protocol is bad and they should feel bad.
- ignoretest 7y ago
  Every Bluetooth device I have ever tried has failed to meet my expectations. I have a drawer full of Bluetooth devices that I regret purchasing. I've been fooled too many times already, I simply won't buy a device that relies on Bluetooth any more. For mouse/keyboard I like RF and for audio you can pry my 3.5mm jack from my cold dead hands.
  - sneak 7y ago
    The AirPods are magical. The only time the magic breaks down is when you're in a place where there is a ton of signal interference (e.g. walking around in busy parts of Manhattan). Aside from that, they're about as close to Just Works as anything I've ever used in my life.
    - arcticbull 7y ago
      Yeah, but they're pretty mediocre headphones in terms of sound quality, and they're built as a single unit making them impossible to recycle.
      - ben-schaaf 7y ago
kstenerud 7y ago
I've gotten so tired of protocols and specifications that are overly complex or are poor fits for how they're used that I've started developing my own for the services I'm implementing [0]. Making protocols & specs no more complex or ambiguous than necessary is a hard requirement in this modern, security-conscious world. [0] https://github.com/kstenerud/specifications https://github.com/kstenerud/specifications
- amelius 7y ago
  Who else is using your specs?
  - kstenerud 7y ago
    I couldn't say; Github doesn't report to me who is including my code or implementing my specs. The point is to make specs that people actually WANT to use, which requires advocacy (to get more eyeballs on it), and collaboration (to fix things I've missed). I build these things to scratch an itch, but I want others to find them useful, as well.
- kennyadam 7y ago
  Reminds me of this XKCD https://xkcd.com/927/ https://xkcd.com/927/
  - kstenerud 7y ago
    If it does, then you've misunderstood what it means. It's about "god" standards, designed to encompass all other standards, a theme common in the 90s.
    - kennyadam 7y ago
      I'd argue that it can apply to any situation where someone is unhappy with the current set of solutions, decided to create a better one for people to use, but simply ends up adding another one to the pile and increasing the convolution.
- 7y ago
DyslexicAtheist 7y ago
it is complex which is usually an issue with security, but the article title makes it sound like maybe security wouldn't be that bad if it weren't for complexity. Bluetooth was broken long before it became complex. A protocol that allows you to negotiate a key size of maximum 1 byte is just plain dumb[1]. [1] https://twitter.com/matthew_d_green/status/1128702003524374534 https://twitter.com/matthew_d_green/status/11287020035243745...
jamewatson 7y ago
Yeah, my toothbrush needs Bluetooth!
ken 7y ago
Also seen this weekend: x86 security issues, presumably also stemming from its complexity. Dijkstra must be rolling in his grave.
borumpilot 7y ago
My main gripe with BT is the inpossibility to limit even which profiles[0] are active. For example: I do not mind allowing audio, but can not allow any form of networking. 0: https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles
jim-jim-jim 7y ago
IIRC OpenBSD dropped bluetooth for this very reason.
moron4hire 7y ago
Complaining about 3000 pages of spec, in comparison to WiFi, is a bit apples-to-oranges. A lot of Bluetooth is not just the binary protocol. There is a huge surface area of what basically amounts to RPC protocols for different, standardized device interfaces. Bluetooth is a wonder for having things like heart rate monitors, pointing devices, and audio interfaces specified in a single, standardized way. You can generally count on a BT device from literally thousands of vendors to behave in the same way in literally thousands of different client devices. It's more fair to compare BT to heavy protocols like ZigBee, or worse yet, ZWave. If you wanna dig into a shit-show of wireless protocols, look no further than ZWave. That thing is a complete boondoggle. I've been pretty happy with BT.
andy_ppp 7y ago
I've been looking for a way to stop bluetooth from pairing with the Macbook asleep, this looks promising to switch it off when the lid is shut at least: https://apple.stackexchange.com/a/272244 https://apple.stackexchange.com/a/272244
geggam 7y ago
You wonder why OpenBSD removed it ?
wolfgke 7y ago
Much shorter and general headline concerning the type of problem: Complexity Is a Security Risk
- ga-vu 7y ago
  Ever since they've paywalled their articles, Wired is FUDing it like crazy.
aschampion 7y ago
The vast majority of my bluetooth woes are not with bluetooth, but with the complete lack of configurability on Android and other devices. I end up pairing/unpairing my home speakers with my phone constantly, not because bluetooth is brittle, but because Android doesn't have options like "remember pairing but don't automatically connect with this device", or, "select audio output", or, "do/dont continue playing audio when this device loses connection". Otherwise, when I turn my headphones on to bike to work in the morning, my phone will be paired with the speakers, and the headphone will connect for calls but not audio. I don't want linux-like configuration. I don't want to root my phone. But having no control on these thousand dollar devices over the most common tasks we use them for despite billions in R&D and tens of thousands of developers is ludicrous.
- JustSomeNobody 7y ago
  It’s funny, anytime anyone mentions the loss of the 3.5mm jack on flagship phones, the loud Bluetooth brigade conveniently forgets just how inconvenient Bluetooth can be.
  - crazygringo 7y ago
    My experience with Apple and Bose devices has been pretty flawless, across keyboards/mice, headphones and speakers. I'm curious if the problems are with Android, with non-premium speakers/headphones, or a combination of the two? And why? (Is it not following the spec, bad UX, or insufficient QA/testing?)
    - slig 7y ago
      > My experience with Apple and Bose devices has been pretty flawless Mine have been terrible. I have a 2018 MB Pro and a pair of QC35 II and it stutters dozens of times during the day. Before that I had a 2014 MB Pro and a cheapo BT headphone and have similar issues.
      - vel0city 7y ago
        I had been using bluetooth headphones without issues for a few years. After moving into a new apartment, I started having all kinds of intermittent problems. Turns out the microwaves in the apartment complex were pretty bad, causing a ton of 2.4GHz noise. The Chromecast would also start dropping video streams whenever my roommate would cook stuff. Is there a source of a ton of 2.4GHz noise causing your problems?
newaccoutnas 7y ago
I've not looked at recent specs but Bluetooth security has always been a bit of a misnomer. It's roots are in FTP etc and older protocols not really designed for security in mind, never was. So to say it's become a security risk, when it already was, may be missing the point.
fithisux 7y ago
I totally agree. Drivers should be easy to write, spec should be slim and modular. It does not stick with the idea of lightweight communication stack.
ohyouHchrist 7y ago
Oh Jesus Christ I want to truck you All over all the highways man. Of I was a curl, would you be my ? Anything? I want to truck you so lard.
- ohyouHchrist 7y ago
  *if
rasz 7y ago
Become??? BT complexity and security were a joke ever since ver 1.1.
Causality1 7y ago
"3,000 pages long" and yet it's still a pain in the ass to use a Bluetooth peripheral with more than one device.
yaseer 7y ago
I have to assume the reason that Bluetooth is still annoying 10 years later is the lack of synchronicity between OS vendors and hardware vendors. Unfortunately, this is something that Apple does well, and most other manufacturers and operating systems have a poorer experience. I say that as an ex-Apple user, not a fanboy. I love my Linux Desktops, but the Bluetooth pairing is a huge pain. Likewise, when I boot into Windows for games - Bluetooth peripherals are far annoying than their Apple counter-parts.
tristor 7y ago
You know what doesn't cause increased attack surface for your devices, doesn't have pairing issues, never cuts out audio randomly, works immediately upon connection, is low power, and doesn't introduce additional RFI into your living space? A headphone jack. Just saying.
- brokenmachine 7y ago
  But I must have a 1mm thinner phone! Expensive timebombed unrepairable accessories is a small price to pay in order to have a 1mm thinner expensive timebombed unrepairable phone!
ddingus 7y ago
I hate bluetooth. I hate pairing viscerally. Recently, I rented a Dodge mini van. Was all they had. The pairing is voice. Fucking menu via voice! It took 10 minutes... Please say: Manage devices Add a new device Configure . . . What priority, say 1 through 5... I say 1. Priority 1 is in use by [device name] And on and on. I was angry when done. I will never use that POS again. Ugh! Someone at Dodge needs to try again. I know you meant well. I know you were probably told to do it too. But damn. It is a real fail. I hate quality changes for very thin reasons. I hate quality changes for technical reasons. I hate charging. About the only time I loved Bluetooth was running windows XP and that excellent driver could pair with my old flip phone and do it all. Network, act as mic, etc... I did it once and done too. Ran that setup for a couple years until I got a better phone. Here is the thing. Brb Back! Had to change devices. I can be convinced to go wireless. It is going to take more than the mess we have today. Just renewed my phone with headphone Jack. Brand new, should be good for years. The wireless devices need to be serviceable, the protocols need to be sane and robust too, or the whole affair is a total net loss.
bondolo 7y ago
It has always been the case. Attending IDC in 1999 before a single device had been certified and the hardware standards and certification docs were already 3500 pages. You can only imagine how this has grown in 20 years. Bluetooth is a "giraffe" technology. It evolved in to the current form through happenstance. Nothing about it is simple or normal, instead randomly weird and inconsistent. And nobody is surprised that after 20 years everyone rightfully assumes that it barely works and is full of holes. However, since the standards are controlled by the people who build the hardware it is not been possible for a functional, non-insane alternative to appear.

229 points by Elof 7y ago

I am using thread which is a lot more sensible https://openthread.io/ https://openthread.io/

It'd be nice if we at least got the easy connectivity promised and just had to work out a few security kinks. https://xkcd.com/2055/ https://xkcd.com/2055/ I have a few Bluetooth speakers. If I accidentally close the app but forget to disconnect from settings too, then no one else can pair with them until I return. This seems like standard behavior, and makes me worry that if I lose my phone at the wrong moment, I might brick a few devices. I really like common standards, but if the consortium can't fix either security or usability, we might be better off with a clean slate.

throwaway2048 7y ago
A clean slate that repeats all the same mistakes in 10 years, but at least we will have a $clean_slate+1 and really get it right this time.
crehn 7y ago
Lately Bluetooth connectivity with Apple devices has been great for me. AirPods just work and everything is pretty snappy and stable.
- baby 7y ago
  Yet there is still quite a lot of friction. Airpods have the best support and they still require you to find out how to pair them when you change device and wait. Keyboard/mouse is insane. If you want to use them with two different laptops.
  - visarga 7y ago
    When I connect my AirPods to my 2015 MBP they don't properly connect unless I open and hover over the speaker icon in the system bar. There's also an issue if I start connection with only the left bud, probably the right bud is the main one?
    - arebours 7y ago
      > There's also an issue if I start connection with only the left bud, probably the right bud is the main one? I think they are symmetrical. You can use both separately, without the other.
  - wongarsu 7y ago
    My mouse (Logitech MX Master) supports Bluetooth. It also supports Logitech' s "Unifying Receiver" and has a button to switch between three different Logitech receivers. I think everyone can guess correctly which of these options just works and always does what you want it to.
    - frosted-flakes 7y ago
      If it's not obvious, the USB receiver works flawlessly. I occasionally have trouble with Bluetooth not connecting (or randomly disconnecting) with the same mouse, but it mostly works okay.
    - omegabravo 7y ago
      To clarify if it's not clear - the button switches between three different receivers, Bluetooth or Logitech unifying receivers. Currently I have 2 BT profiles, and 1 Logitech. The mouse works flawlessly
thrower123 7y ago
I've gotten bluetooth to work a handful of times. I've not been able to repeat that feat enough times to figure out why it works when it works and doesn't work when it doesn't, so I just throw my hands up and stick to aux and USB wired connections.
a012 7y ago
I bought a Bluetooth speaker and only Apple devices can use it smoothly, my Android 8/9 phone remembers its paired speaker but can't connect it unless I unpair them, press speaker's pair button, pair my phone again every single times. I plan to buy a DAC that support Spotify connect.
Swizec 7y ago
My favorite part is when headphones connect to the laptop in my backpack that’s closed and the laptop I’m currently using. They play music successfully but volume is set to 0 because I guess macOS does that in sleep mode. So I have to open up the sleeping laptop just to disconnect bluetooth

s_m_t 7y ago

In my opinion part of the problem with Bluetooth is that the API exposed by android and IOS is like... two or three layers too low. Imagine if in web programming you set the MTU size in your HTML and you get the idea of what programming Bluetooth is like. Another issue I see is more of a view point that people have trouble shaking. Typically we think of the server as being more powerful than the client, but in BLE the client usually has more processing power and battery by several orders of magnitude. Once you examine this preconception BLE makes a whole lot more sense.

fopen64 7y ago
You mean the BLE API? In classic Bluetooth the main problem was the lack of APIs, only SPP is supported (and not even that, in iOS). Bluetooth is really a good bad example of committee design.
- gHosts 7y ago
  Wellllll, HCI is your API as far as bluetooth.org is concerned...
sratner 7y ago
It isn't even the API vendors' fault necessarily. Compared to HTTP/TCP/IP, abstractions between layers of the BLE stack are extremely leaky. Examples: indicating choice of PHY coding and channels in the equivalent of a `listen/connect` call, or the three different but intertwined places where fragmentation/reassembly can happen. Being effective with BLE requires deep understanding of the entire stack, and since it is difficult for a single person to have such level of understanding, we get bugs. By comparison, being effective with HTTP does not require one to know anything about the PHY layer, or TCP stream reassembly. I suspect this is due to not having enough independent implementations of each layer - Bluetooth is designed and standardized by one committee, and the entire stack usually implemented as a single "thing", making it too easy to break abstraction when a new feature needs to be added.
- arcticbull 7y ago

ikeboy 7y ago

How come we can't solve lag? There should be a part of the protocol that determines the lag and a standard way for programs to then set their delay accordingly, so that when I'm watching a video the sound is synced with the screen. Instead I have to manually try several different lag times until one feels good enough.

aantthony 7y ago
It seems the AirPods do this. It will delay the video so that it’s in sync. It might already be in the protocol.
- ikeboy 7y ago
  I know that VLC on Android needs the audio sync delay to be set manually, and VLC is usually great about implementing features when possible so I assumed it wasn't part of the protocol.
jjcm 7y ago
It seems like something endemic to the protocol. Logitech's recent wireless mice/keyboards have skipped bluetooth altogether - they determined the lag was simply too large for high performance gaming: https://www.reddit.com/r/MouseReview/comments/99qq4a/about_that_1ms_lightspeed_wireless_technology/ https://www.reddit.com/r/MouseReview/comments/99qq4a/about_t...
- MrBuddyCasino 7y ago
  I have a Logitech G603 mouse that supports both, and there is no noticeable lag when using the proprietary dongle. I'm still glad BT is supported as a fallback, but the lag is undeniable.

gHosts 7y ago

Become? Become!? That's funny. That's Rich. Do you have any idea how bloody insanely complex bluetooth is? Just the the core stuff, https://www.bluetooth.com/specifications/bluetooth-core-specification/ https://www.bluetooth.com/specifications/bluetooth-core-spec... without the various protocol specs... https://www.bluetooth.com/specifications/protocol-specifications/ https://www.bluetooth.com/specifications/protocol-specificat... or the GATT or ... The bloody core spec is 3000 PAGES of standardese. All in stuff that costs less than a dollar per chip.

techslave 7y ago
what’s is your point about it being a dollar per chip? that it’s implemented by super cheap labor or something? silicon is free. you are paying for the r&d. that’s why volume matters. at the volume of bluetooth chips, they are almost indeed free. most of that dollar is distribution costs. my point is, the cost of the chip isn’t a signal of anything except the ubiquity of it.
- gHosts 7y ago
  True. The likes of broadcom are hugely sophisticated and really really understand the spec. But _none_ of your consumer level gadgets are made by broadcom. Broadcom will sell millions of these cheap as chips chips to second tier players. Who may sell on to third tier players. Who buy or pull a bluetooth stack and sort of vaguely maybe know what they doing, tie it all together and get the BT compliance stamp (which sort of means it doesn't shit all over the RF spectrum and vaguely works)... ...and then the sell it to you. ie. The chip manufacturer hopefully has clue.... then it gallops rapidly downhill from there.
  - Paul_S 7y ago
    All Bluetooth chips come with SDKs and depending on your solution another API in the OS of your board. At that point clients don't need to know much about bt and from my experience don't care beyond "how do I make these bytes appear on the other side". BT is massive but that's mostly BT classic which is slowly going away as more and more chips are BLE only which is saner. That's why we're adding isochronous channels to keep it interesting.

baby 7y ago

The funny thing is that the protocol is meant to be run by tiny devices. So of course one would thing they would have attempted to make it simple.

Paul_S 7y ago
If you want simple you can build your own on top of 15.4. This way your device will work but only with your other device. The big thing about BT is that it's everywhere.
- kkarakk 7y ago
  The top players (apple/samsung) have switched to proprietary stacks on top of bluetooth to get the "magic" pairing experience. Google is following suite soon. On non "magic" pairing devices, bt is still a pain in the ass to get to work comparatively. Imagine if you had to do the standard bt pairing process for wifi. Device to connect to has to be broadcasting, Device trying to connect has to be listening, after connection you have to ensure that the passcodes are the same etc etc. If the connection drops then repeat the process sometimes(<BT 5.0).

gtirloni 7y ago

What happened to UWB as an alternative for Wireless PAN? I remember it being proposed as an alternative. Is it any easier to use/secure? The high frequencies should work fine for short ranges, no?

Paul_S 7y ago

The problem with BT is not unique to BT. Any protocol at the time when it's used by app developers is not understood and misused. Most products in the wild just use the example code provided in the sdks provided. You can make a whole product this way. Especially simple stuff like bt speakers.

ahartmetz 7y ago

The problems with Bluetooth are it doesn't pair, it doesn't unpair, you need to unpair first, you need to use the other protocol that transmits audio, the latency is way too high, it's insecure, the software stack hangs or crashes, you can't know for sure if two devices will work together, BLE is WAY too low level and a step back, the spec is way too big and complicated, ... In 20 years they have not managed to make it good. It seems hopeless with the current institutions managing it. What a heap of hot garbage.

B-Con 7y ago
And they wonder why there's resistance to phones that are wireless only. Their wireless audio protocol is bad and they should feel bad.
ignoretest 7y ago
Every Bluetooth device I have ever tried has failed to meet my expectations. I have a drawer full of Bluetooth devices that I regret purchasing. I've been fooled too many times already, I simply won't buy a device that relies on Bluetooth any more. For mouse/keyboard I like RF and for audio you can pry my 3.5mm jack from my cold dead hands.
- sneak 7y ago
  The AirPods are magical. The only time the magic breaks down is when you're in a place where there is a ton of signal interference (e.g. walking around in busy parts of Manhattan). Aside from that, they're about as close to Just Works as anything I've ever used in my life.
  - arcticbull 7y ago
    Yeah, but they're pretty mediocre headphones in terms of sound quality, and they're built as a single unit making them impossible to recycle.
    - ben-schaaf 7y ago

kstenerud 7y ago

I've gotten so tired of protocols and specifications that are overly complex or are poor fits for how they're used that I've started developing my own for the services I'm implementing [0]. Making protocols & specs no more complex or ambiguous than necessary is a hard requirement in this modern, security-conscious world. [0] https://github.com/kstenerud/specifications https://github.com/kstenerud/specifications

amelius 7y ago
Who else is using your specs?
- kstenerud 7y ago
  I couldn't say; Github doesn't report to me who is including my code or implementing my specs. The point is to make specs that people actually WANT to use, which requires advocacy (to get more eyeballs on it), and collaboration (to fix things I've missed). I build these things to scratch an itch, but I want others to find them useful, as well.
kennyadam 7y ago
Reminds me of this XKCD https://xkcd.com/927/ https://xkcd.com/927/
- kstenerud 7y ago
  If it does, then you've misunderstood what it means. It's about "god" standards, designed to encompass all other standards, a theme common in the 90s.
  - kennyadam 7y ago
    I'd argue that it can apply to any situation where someone is unhappy with the current set of solutions, decided to create a better one for people to use, but simply ends up adding another one to the pile and increasing the convolution.
7y ago

DyslexicAtheist 7y ago

it is complex which is usually an issue with security, but the article title makes it sound like maybe security wouldn't be that bad if it weren't for complexity. Bluetooth was broken long before it became complex. A protocol that allows you to negotiate a key size of maximum 1 byte is just plain dumb[1]. [1] https://twitter.com/matthew_d_green/status/1128702003524374534 https://twitter.com/matthew_d_green/status/11287020035243745...

jamewatson 7y ago

Yeah, my toothbrush needs Bluetooth!

ken 7y ago

Also seen this weekend: x86 security issues, presumably also stemming from its complexity. Dijkstra must be rolling in his grave.

borumpilot 7y ago

My main gripe with BT is the inpossibility to limit even which profiles[0] are active. For example: I do not mind allowing audio, but can not allow any form of networking. 0: https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles

jim-jim-jim 7y ago

IIRC OpenBSD dropped bluetooth for this very reason.

moron4hire 7y ago

Complaining about 3000 pages of spec, in comparison to WiFi, is a bit apples-to-oranges. A lot of Bluetooth is not just the binary protocol. There is a huge surface area of what basically amounts to RPC protocols for different, standardized device interfaces. Bluetooth is a wonder for having things like heart rate monitors, pointing devices, and audio interfaces specified in a single, standardized way. You can generally count on a BT device from literally thousands of vendors to behave in the same way in literally thousands of different client devices. It's more fair to compare BT to heavy protocols like ZigBee, or worse yet, ZWave. If you wanna dig into a shit-show of wireless protocols, look no further than ZWave. That thing is a complete boondoggle. I've been pretty happy with BT.

andy_ppp 7y ago

I've been looking for a way to stop bluetooth from pairing with the Macbook asleep, this looks promising to switch it off when the lid is shut at least: https://apple.stackexchange.com/a/272244 https://apple.stackexchange.com/a/272244

geggam 7y ago

You wonder why OpenBSD removed it ?

wolfgke 7y ago

Much shorter and general headline concerning the type of problem: Complexity Is a Security Risk

ga-vu 7y ago
Ever since they've paywalled their articles, Wired is FUDing it like crazy.

aschampion 7y ago

The vast majority of my bluetooth woes are not with bluetooth, but with the complete lack of configurability on Android and other devices. I end up pairing/unpairing my home speakers with my phone constantly, not because bluetooth is brittle, but because Android doesn't have options like "remember pairing but don't automatically connect with this device", or, "select audio output", or, "do/dont continue playing audio when this device loses connection". Otherwise, when I turn my headphones on to bike to work in the morning, my phone will be paired with the speakers, and the headphone will connect for calls but not audio. I don't want linux-like configuration. I don't want to root my phone. But having no control on these thousand dollar devices over the most common tasks we use them for despite billions in R&D and tens of thousands of developers is ludicrous.

JustSomeNobody 7y ago
It’s funny, anytime anyone mentions the loss of the 3.5mm jack on flagship phones, the loud Bluetooth brigade conveniently forgets just how inconvenient Bluetooth can be.
- crazygringo 7y ago
  My experience with Apple and Bose devices has been pretty flawless, across keyboards/mice, headphones and speakers. I'm curious if the problems are with Android, with non-premium speakers/headphones, or a combination of the two? And why? (Is it not following the spec, bad UX, or insufficient QA/testing?)
  - slig 7y ago
    > My experience with Apple and Bose devices has been pretty flawless Mine have been terrible. I have a 2018 MB Pro and a pair of QC35 II and it stutters dozens of times during the day. Before that I had a 2014 MB Pro and a cheapo BT headphone and have similar issues.
    - vel0city 7y ago
      I had been using bluetooth headphones without issues for a few years. After moving into a new apartment, I started having all kinds of intermittent problems. Turns out the microwaves in the apartment complex were pretty bad, causing a ton of 2.4GHz noise. The Chromecast would also start dropping video streams whenever my roommate would cook stuff. Is there a source of a ton of 2.4GHz noise causing your problems?

newaccoutnas 7y ago

I've not looked at recent specs but Bluetooth security has always been a bit of a misnomer. It's roots are in FTP etc and older protocols not really designed for security in mind, never was. So to say it's become a security risk, when it already was, may be missing the point.

fithisux 7y ago

I totally agree. Drivers should be easy to write, spec should be slim and modular. It does not stick with the idea of lightweight communication stack.

ohyouHchrist 7y ago

Oh Jesus Christ I want to truck you All over all the highways man. Of I was a curl, would you be my ? Anything? I want to truck you so lard.

ohyouHchrist 7y ago
*if

rasz 7y ago

Become??? BT complexity and security were a joke ever since ver 1.1.

Causality1 7y ago

"3,000 pages long" and yet it's still a pain in the ass to use a Bluetooth peripheral with more than one device.

yaseer 7y ago

I have to assume the reason that Bluetooth is still annoying 10 years later is the lack of synchronicity between OS vendors and hardware vendors. Unfortunately, this is something that Apple does well, and most other manufacturers and operating systems have a poorer experience. I say that as an ex-Apple user, not a fanboy. I love my Linux Desktops, but the Bluetooth pairing is a huge pain. Likewise, when I boot into Windows for games - Bluetooth peripherals are far annoying than their Apple counter-parts.

tristor 7y ago

You know what doesn't cause increased attack surface for your devices, doesn't have pairing issues, never cuts out audio randomly, works immediately upon connection, is low power, and doesn't introduce additional RFI into your living space? A headphone jack. Just saying.

brokenmachine 7y ago
But I must have a 1mm thinner phone! Expensive timebombed unrepairable accessories is a small price to pay in order to have a 1mm thinner expensive timebombed unrepairable phone!

ddingus 7y ago

I hate bluetooth. I hate pairing viscerally. Recently, I rented a Dodge mini van. Was all they had. The pairing is voice. Fucking menu via voice! It took 10 minutes... Please say: Manage devices Add a new device Configure . . . What priority, say 1 through 5... I say 1. Priority 1 is in use by [device name] And on and on. I was angry when done. I will never use that POS again. Ugh! Someone at Dodge needs to try again. I know you meant well. I know you were probably told to do it too. But damn. It is a real fail. I hate quality changes for very thin reasons. I hate quality changes for technical reasons. I hate charging. About the only time I loved Bluetooth was running windows XP and that excellent driver could pair with my old flip phone and do it all. Network, act as mic, etc... I did it once and done too. Ran that setup for a couple years until I got a better phone. Here is the thing. Brb Back! Had to change devices. I can be convinced to go wireless. It is going to take more than the mess we have today. Just renewed my phone with headphone Jack. Brand new, should be good for years. The wireless devices need to be serviceable, the protocols need to be sane and robust too, or the whole affair is a total net loss.

bondolo 7y ago

It has always been the case. Attending IDC in 1999 before a single device had been certified and the hardware standards and certification docs were already 3500 pages. You can only imagine how this has grown in 20 years. Bluetooth is a "giraffe" technology. It evolved in to the current form through happenstance. Nothing about it is simple or normal, instead randomly weird and inconsistent. And nobody is surprised that after 20 years everyone rightfully assumes that it barely works and is full of holes. However, since the standards are controlled by the people who build the hardware it is not been possible for a functional, non-insane alternative to appear.