6 ms·

There's also the bit where Zigbee devices have to share a secret key to talk to each other, mostly to prevent competition from low cost devices manufactured in

There's also the bit where Zigbee devices have to share a secret key to talk to each other, mostly to prevent competition from low cost devices manufactured in China.

Spivak 7y ago
Yeah! They want you to use the high cost devices manufactured in China.
- ASalazarMX 7y ago
  Or mostly the same cheap devices manufactured in China but sold through your friendly middlemen.
- syshum 7y ago
  No, American Marketing Companies (Apple, Amazon, Google, Etc) want to use the Cheap China Manufacturers, they just dont want consumers to be able to buy them direct
PaulHoule 7y ago
Key exchange for IoT devices is a tricky problem. IoT devices don't support public key infrastructure, e.g. something like GnuPG or the SSL certificates used by web browsers. It's a very practical solution to have a shared secret between the device and a central server, and, at registration time, have the central server make a key for both the hub and the device. Without some kind of key exchange, people could set off your alarm, turn on your lights, open your door...
- AnthonyMouse 7y ago
  The solution is to have a pairing mode that allows the device to be paired with a control device (e.g. your phone) via wireless while you're in the same room as it. That would only have to be done once when it's installed and require pressing a physical button on the device while being in wireless range so that nobody can hack it remotely.
  - Avamander 7y ago
    Out-of-band pairing is a better idea, e.g. some key on the bulb has to be entered or scanned or read on the device.
    - AnthonyMouse 7y ago
      The trouble with that is that you can't change it in case e.g. some temporary visitor to your house snaps a picture of the key.
      - tjoff 7y ago
        That shouldn't do them any good. The device should require it to be in pairing mode for the key to do anything.
        AnthonyMouse 7y ago
        But then what do you need the key for? In theory somebody else could try to pair with it while you have it in pairing mode, but they would have to be on your property for that and could potentially see the key anyway. So you go slap them with a trout or call the police or something, and then go back to setting up your future garbage.
        tjoff 7y ago
        So that that initial pairing is more secure. Zigbee etc. tries to get around the whole thing by requiring that the pairing process is done from a 5cm or something distance. Imho that is good enough but I don't know how far you could extend it with directional antennas etc. That anyone can reclaim a device they hold in their hand is a feature.
      - cossray 7y ago
        If you as an individual has visitors who come to your house and snap pictures of codes in your devices... I wouldn't be more expectant of Zigbee or any other standards, rather I would be more keen on the visitors I allow into my house.
TheKarateKid 7y ago
> mostly to prevent competition from low cost devices manufactured in China. mostly to prevent competition from patent-infringing clones manufactured in China. FIFY
- Symmetry 7y ago
  I actually worked at Ember for a bit before leaving when they get bought by Silicon Labs. The reason, internally, really was the fear that there would be a flood of low quality products that would make ZigBee look bad.
  - rasz 7y ago
    as opposed to ZigBee making ZigBee look bad as it stands now. Only big names looking for a lockin pick ZigBee.
  - Reelin 7y ago
    > fear that there would be a flood of low quality products That's mental gymnastics. The fear is having to compete against cheaper products (possibly low quality, but possibly not). Even broken DRM is an excellent anti-competitive tool because no one can legally sell a competing product.
  - nine_k 7y ago
    For that, you need certification, not gatekeeping. Publish a set of tests a device must pass, broadly, to be certified compliant. Allow manufacturers test their devices, for a fee, and win a certificate, or know where they failed. Much like you can take a language exam (say, TOEFL).
mavhc 7y ago
When they kept the already known secret key for pairing bulbs in the new supposedly secret version of Zigbee it was obvious they didn't care about security at all
- semi-extrinsic 7y ago
  After all the "S" in IoT stands for Security.
  - SEJeff 7y ago
    I literally have an SSID on my Ubiquiti WAP with that as the name.
JEOII 7y ago
If you look at the Zigbee member list, there are many China based companies. They don't need to 'steal' anything as members.
- saagarjha 7y ago
  The comment mentioned nothing about stealing.
  - JEOII 7y ago
    True. I was looking at TheKarateKid comment about infringing companies. The country where most stuff is manufactured, white labelled and sold at a premium by brand names :)

There's also the bit where Zigbee devices have to share a secret key to talk to each other, mostly to prevent competition from low cost devices manufactured in China.

Spivak 7y ago

Yeah! They want you to use the high cost devices manufactured in China.

ASalazarMX 7y ago
Or mostly the same cheap devices manufactured in China but sold through your friendly middlemen.
syshum 7y ago
No, American Marketing Companies (Apple, Amazon, Google, Etc) want to use the Cheap China Manufacturers, they just dont want consumers to be able to buy them direct

PaulHoule 7y ago

Key exchange for IoT devices is a tricky problem. IoT devices don't support public key infrastructure, e.g. something like GnuPG or the SSL certificates used by web browsers. It's a very practical solution to have a shared secret between the device and a central server, and, at registration time, have the central server make a key for both the hub and the device. Without some kind of key exchange, people could set off your alarm, turn on your lights, open your door...

AnthonyMouse 7y ago
The solution is to have a pairing mode that allows the device to be paired with a control device (e.g. your phone) via wireless while you're in the same room as it. That would only have to be done once when it's installed and require pressing a physical button on the device while being in wireless range so that nobody can hack it remotely.
- Avamander 7y ago
  Out-of-band pairing is a better idea, e.g. some key on the bulb has to be entered or scanned or read on the device.
  - AnthonyMouse 7y ago
    The trouble with that is that you can't change it in case e.g. some temporary visitor to your house snaps a picture of the key.
    - tjoff 7y ago
      That shouldn't do them any good. The device should require it to be in pairing mode for the key to do anything.
      - AnthonyMouse 7y ago
        But then what do you need the key for? In theory somebody else could try to pair with it while you have it in pairing mode, but they would have to be on your property for that and could potentially see the key anyway. So you go slap them with a trout or call the police or something, and then go back to setting up your future garbage.
        tjoff 7y ago
        So that that initial pairing is more secure. Zigbee etc. tries to get around the whole thing by requiring that the pairing process is done from a 5cm or something distance. Imho that is good enough but I don't know how far you could extend it with directional antennas etc. That anyone can reclaim a device they hold in their hand is a feature.
    - cossray 7y ago
      If you as an individual has visitors who come to your house and snap pictures of codes in your devices... I wouldn't be more expectant of Zigbee or any other standards, rather I would be more keen on the visitors I allow into my house.

TheKarateKid 7y ago

> mostly to prevent competition from low cost devices manufactured in China. mostly to prevent competition from patent-infringing clones manufactured in China. FIFY

Symmetry 7y ago
I actually worked at Ember for a bit before leaving when they get bought by Silicon Labs. The reason, internally, really was the fear that there would be a flood of low quality products that would make ZigBee look bad.
- rasz 7y ago
  as opposed to ZigBee making ZigBee look bad as it stands now. Only big names looking for a lockin pick ZigBee.
- Reelin 7y ago
  > fear that there would be a flood of low quality products That's mental gymnastics. The fear is having to compete against cheaper products (possibly low quality, but possibly not). Even broken DRM is an excellent anti-competitive tool because no one can legally sell a competing product.
- nine_k 7y ago
  For that, you need certification, not gatekeeping. Publish a set of tests a device must pass, broadly, to be certified compliant. Allow manufacturers test their devices, for a fee, and win a certificate, or know where they failed. Much like you can take a language exam (say, TOEFL).

mavhc 7y ago

When they kept the already known secret key for pairing bulbs in the new supposedly secret version of Zigbee it was obvious they didn't care about security at all

semi-extrinsic 7y ago
After all the "S" in IoT stands for Security.
- SEJeff 7y ago
  I literally have an SSID on my Ubiquiti WAP with that as the name.

JEOII 7y ago

If you look at the Zigbee member list, there are many China based companies. They don't need to 'steal' anything as members.

saagarjha 7y ago
The comment mentioned nothing about stealing.
- JEOII 7y ago
  True. I was looking at TheKarateKid comment about infringing companies. The country where most stuff is manufactured, white labelled and sold at a premium by brand names :)