5 ms·

The reason I can say my smarthome is relatively secure is explicitly because it doesn't use IP. It's good they're trying to standardize, but you're gonna have a

The reason I can say my smarthome is relatively secure is explicitly because it doesn't use IP. It's good they're trying to standardize, but you're gonna have a problem when you try to use a firewall to inspect what these devices are up to and find that they're all making encrypted tunnels back to their home bases and won't work without them.

StavrosK 7y ago
The reason I can say my smarthome is relatively secure is because I don't allow any of the devices to access the internet. IP or not seems irrelevant.
- ocdtrekkie 7y ago
  The high level of sophistication of IP networking and the fact that one small mistake could mean your devices access the Internet is why a network that doesn't talk IP is almost inherently safer than one that does.
  - deleted 7y ago
    [deleted]
  - ViViDboarder 7y ago
    There is a great point here you haven’t made yet. It may seem trivial for those of us on HN to block IP devices from the internet, but the average user will not know how to do that effectively. They are also the ones who’s devices probably remain on a botnet undetected by their owners. That said, most hubs (required for these types of devices) connect to the internet by default anyway. It does reduce risk a bit as vulnerability in a node isn’t exploitable remotely.
  - icebraining 7y ago
    There's no sophistication: just plug a Wifi router to an outlet but not to the Internet cable.
- orev 7y ago
  I think any home automation system should not have to rely on the home owner having a CCNA cert in order to be secure.
  - icebraining 7y ago
    Buying a Wifi router and not plugging it to the Internet doesn't require a CCNA cert. Yes, it's an extra device, but so is the Zigbee hub.
    - orev 7y ago
      Most people are not going to buy a dedicated WiFi AP just for their home automation. The benefit of Zigbee, even when using a hub, is that you don’t have all the actual devices on your network, calling home, and possibly opening up NAT traversal streams. You just need to worry about the hub. With WiFi devices, you need to worry about all of that for all of them.
slantyyz 7y ago
I've been gradually retiring my wifi smart devices in favor of Z-wave because I find them far more reliable and much easier to maintain and manage. It's also a little annoying having a pile of wifi devices whose only purpose is to manage an on-off state consume IP addresses on my network.
- technofiend 7y ago
  I share your need to name all my devices in the controller view. Hopefully zwave has better security support than typical IoT devices. I'd really prefer to use certificates rather than WPA passwords because password rotation requires a) I give vendors my passwords which they may not really secure in any way, b) often requires I use a vendor tool to rotate said password. It would be much preferable to have a standard way to store a certificate to the device. Today when the inevitable happens and someone leaves customer WPA passwords on an open S3 bucket, or they're exposed via cyber security break I have to update every device. It would be so much nicer to just go update my compromised device's certificate rather than the password for everything. Frankly I'd prefer certificates to passwords anyway because sooner or later I'm sure WEP2 itself will be broken.
- 1over137 7y ago
  Consume IP addresses? There are a bazillion IP addresses. Or are you stuck on IPv4?
  - orev 7y ago
    Pretty much everyone (especially at home) is using only IPv4. IPv6 is always perpetually on the horizon. The better argument would have been that using a /23 or /22 subnet should probably be enough for most home automation setups.
    - GhettoMaestro 7y ago
      5 years ago your comment was spot on. Now in the us it is common to see dual stack v4 v6 on residential and mobile connections.
eeZah7Ux 7y ago
This is false sense of security. Industrial SCADA and CAN networks have been found full of vulnerabilities because people assumed they were magically secure by simply not using IP. You can easily isolate an IP network and inspect its traffic. You cannot easily inspect less common protocols. Obscurity and lack of tools never helps security.

StavrosK 7y ago

The reason I can say my smarthome is relatively secure is because I don't allow any of the devices to access the internet. IP or not seems irrelevant.

ocdtrekkie 7y ago
The high level of sophistication of IP networking and the fact that one small mistake could mean your devices access the Internet is why a network that doesn't talk IP is almost inherently safer than one that does.
- deleted 7y ago
  [deleted]
- ViViDboarder 7y ago
  There is a great point here you haven’t made yet. It may seem trivial for those of us on HN to block IP devices from the internet, but the average user will not know how to do that effectively. They are also the ones who’s devices probably remain on a botnet undetected by their owners. That said, most hubs (required for these types of devices) connect to the internet by default anyway. It does reduce risk a bit as vulnerability in a node isn’t exploitable remotely.
- icebraining 7y ago
  There's no sophistication: just plug a Wifi router to an outlet but not to the Internet cable.
orev 7y ago
I think any home automation system should not have to rely on the home owner having a CCNA cert in order to be secure.
- icebraining 7y ago
  Buying a Wifi router and not plugging it to the Internet doesn't require a CCNA cert. Yes, it's an extra device, but so is the Zigbee hub.
  - orev 7y ago
    Most people are not going to buy a dedicated WiFi AP just for their home automation. The benefit of Zigbee, even when using a hub, is that you don’t have all the actual devices on your network, calling home, and possibly opening up NAT traversal streams. You just need to worry about the hub. With WiFi devices, you need to worry about all of that for all of them.

slantyyz 7y ago

I've been gradually retiring my wifi smart devices in favor of Z-wave because I find them far more reliable and much easier to maintain and manage. It's also a little annoying having a pile of wifi devices whose only purpose is to manage an on-off state consume IP addresses on my network.

technofiend 7y ago
I share your need to name all my devices in the controller view. Hopefully zwave has better security support than typical IoT devices. I'd really prefer to use certificates rather than WPA passwords because password rotation requires a) I give vendors my passwords which they may not really secure in any way, b) often requires I use a vendor tool to rotate said password. It would be much preferable to have a standard way to store a certificate to the device. Today when the inevitable happens and someone leaves customer WPA passwords on an open S3 bucket, or they're exposed via cyber security break I have to update every device. It would be so much nicer to just go update my compromised device's certificate rather than the password for everything. Frankly I'd prefer certificates to passwords anyway because sooner or later I'm sure WEP2 itself will be broken.
1over137 7y ago
Consume IP addresses? There are a bazillion IP addresses. Or are you stuck on IPv4?
- orev 7y ago
  Pretty much everyone (especially at home) is using only IPv4. IPv6 is always perpetually on the horizon. The better argument would have been that using a /23 or /22 subnet should probably be enough for most home automation setups.
  - GhettoMaestro 7y ago
    5 years ago your comment was spot on. Now in the us it is common to see dual stack v4 v6 on residential and mobile connections.

eeZah7Ux 7y ago

This is false sense of security. Industrial SCADA and CAN networks have been found full of vulnerabilities because people assumed they were magically secure by simply not using IP. You can easily isolate an IP network and inspect its traffic. You cannot easily inspect less common protocols. Obscurity and lack of tools never helps security.