11 ms·

Plus they are a Shanghai-based company and can be compelled by the Chinese government to place hardware back doors. (They are great for makers though, very aff

Plus they are a Shanghai-based company and can be compelled by the Chinese government to place hardware back doors. (They are great for makers though, very affordable, lots of features.)

mendesgeo 7y ago
hahaha, this is not a backdoor. It's just logical implementation flaws. If wifi products had good certification, this things wouldn't happen.
- guiambros 7y ago
  Parent didn't say this was a backdoor; just that they "can be compelled" to add one, if requested by the Chinese government in the future. Sadly this isn't a tin foil hat possibility.
  - ncmncm 7y ago
    Not unique to Chinese firms either. Sprint resisted blanket surveillance, for a while, and were finally coerced into line. Do you imagine hardware vendors are immune to the same pressure, in the US, Japan, and Europe?
squarefoot 7y ago
Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary push for open drivers/firmware (Broadcom itself, just to name one, has had strong ties with the US govt for a long time). I can imagine a meeting in which some high rank officer says "Here's our backdoor blob, you merge this to all your chipsets firmware, so when necessary we can selectively either shut off Ethernet chips or have them relay information elsewhere as instructed through magic packets, which of course won't be noticed because the leds won't blink and any other chipset seeing these packets will comply as well letting them pass through without allowing any form of sniffing or telling the system administrator (1)". I can't imagine any manufacturer risking their business by replying "nope, we won't comply"; they will jump when commanded to do so and if caught the standard reply will be "we were forced" or "they say it's for national security, you know, to catch those evil terrorists!". (1) it may seem absurd, sort of sci-fi, but having access to the underlying hardware and its firmware would make it not that hard to do. In that case, the only way to safely analyze network traffic would require very fast logic analyzers that wouldn't use any dedicated network chipsets. The point is: security through obscurity usually doesn't work well, unless the untrusted party is the hardware maker itself, or whoever decides what they put in the hardware; in that case security through obscurity becomes a lot more about obscurity than security, which makes it near 100% effective.
- nabla9 7y ago
  > Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary This is false. In most western countries governments cant force HW makers to add backdoor.
  - dv_dt 7y ago
    Portions of the US government have tried multiple times to make the addition of backdoors required via public force of law. They're still trying to promote it now. Short of that public requirement, they can ask & issue orders to not discuss the matter, tie it with defense orders, or imply the withholding of export or trade licenses, all contingent upon cooperation. In the end it looks pretty blurry between a request for cooperation and and order. Even in China, they might not need to rely on explicit state security authority, just tie it up with state sponsored funding or other softer measures.
    - nabla9 7y ago
      > they can ask & issue orders to not discuss the matter, They can't do that.
      - dv_dt 7y ago
        Why not in the form of a National Security letter? https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter
        nl 7y ago
        No, a national security letter can't do this. It can only compel the release of collected metadata to agencies.
        dv_dt 7y ago
        Are holes in security infrastructure required to collect metadata? Are keys, data that secures content - considered metadata? They're not content. Since you can't discuss the letters publicly, a claim could be that it is metadata, and compel keeping the request to collect it as such secret - similarly the fight from the silenced party, if there were any fight, could be out of public visibility.
bpye 7y ago
Ive looked - a lot - to try and find a reasonable alternative. I haven't found any devices that are as inexpensive and convenient as the ESP chips. Microchip have some relatively inexpensive WiFi modules that need to be used with another MCU and Silabs have some modules including an ARM MCU (WGM160P). These still need blobs but I'm a little happier with a larger more established silicon vendor.
- Gibbon1 7y ago
  I think (at least a couple of years ago) you could get a dev kit for Microchips parts. The difficulty was then you're responsible for keeping the WiFi stack up to date.
ospider 7y ago
> Plus they are a Shanghai-based company and can be compelled by the Chinese government to place hardware back doors. Plus Broadcom is a US-based company and can be compelled by the US government to place hardware back doors.

Plus they are a Shanghai-based company and can be compelled by the Chinese government to place hardware back doors. (They are great for makers though, very affordable, lots of features.)

mendesgeo 7y ago

hahaha, this is not a backdoor. It's just logical implementation flaws. If wifi products had good certification, this things wouldn't happen.

guiambros 7y ago
Parent didn't say this was a backdoor; just that they "can be compelled" to add one, if requested by the Chinese government in the future. Sadly this isn't a tin foil hat possibility.
- ncmncm 7y ago
  Not unique to Chinese firms either. Sprint resisted blanket surveillance, for a while, and were finally coerced into line. Do you imagine hardware vendors are immune to the same pressure, in the US, Japan, and Europe?

squarefoot 7y ago

Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary push for open drivers/firmware (Broadcom itself, just to name one, has had strong ties with the US govt for a long time). I can imagine a meeting in which some high rank officer says "Here's our backdoor blob, you merge this to all your chipsets firmware, so when necessary we can selectively either shut off Ethernet chips or have them relay information elsewhere as instructed through magic packets, which of course won't be noticed because the leds won't blink and any other chipset seeing these packets will comply as well letting them pass through without allowing any form of sniffing or telling the system administrator (1)". I can't imagine any manufacturer risking their business by replying "nope, we won't comply"; they will jump when commanded to do so and if caught the standard reply will be "we were forced" or "they say it's for national security, you know, to catch those evil terrorists!". (1) it may seem absurd, sort of sci-fi, but having access to the underlying hardware and its firmware would make it not that hard to do. In that case, the only way to safely analyze network traffic would require very fast logic analyzers that wouldn't use any dedicated network chipsets. The point is: security through obscurity usually doesn't work well, unless the untrusted party is the hardware maker itself, or whoever decides what they put in the hardware; in that case security through obscurity becomes a lot more about obscurity than security, which makes it near 100% effective.

nabla9 7y ago
> Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary This is false. In most western countries governments cant force HW makers to add backdoor.
- dv_dt 7y ago
  Portions of the US government have tried multiple times to make the addition of backdoors required via public force of law. They're still trying to promote it now. Short of that public requirement, they can ask & issue orders to not discuss the matter, tie it with defense orders, or imply the withholding of export or trade licenses, all contingent upon cooperation. In the end it looks pretty blurry between a request for cooperation and and order. Even in China, they might not need to rely on explicit state security authority, just tie it up with state sponsored funding or other softer measures.
  - nabla9 7y ago
    > they can ask & issue orders to not discuss the matter, They can't do that.
    - dv_dt 7y ago
      Why not in the form of a National Security letter? https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter
      - nl 7y ago
        No, a national security letter can't do this. It can only compel the release of collected metadata to agencies.
        dv_dt 7y ago
        Are holes in security infrastructure required to collect metadata? Are keys, data that secures content - considered metadata? They're not content. Since you can't discuss the letters publicly, a claim could be that it is metadata, and compel keeping the request to collect it as such secret - similarly the fight from the silenced party, if there were any fight, could be out of public visibility.

bpye 7y ago

Ive looked - a lot - to try and find a reasonable alternative. I haven't found any devices that are as inexpensive and convenient as the ESP chips. Microchip have some relatively inexpensive WiFi modules that need to be used with another MCU and Silabs have some modules including an ARM MCU (WGM160P). These still need blobs but I'm a little happier with a larger more established silicon vendor.

Gibbon1 7y ago
I think (at least a couple of years ago) you could get a dev kit for Microchips parts. The difficulty was then you're responsible for keeping the WiFi stack up to date.

ospider 7y ago

> Plus they are a Shanghai-based company and can be compelled by the Chinese government to place hardware back doors. Plus Broadcom is a US-based company and can be compelled by the US government to place hardware back doors.