16 ms·

I get uncomfortable how this is probably true with all these smart TVs as well (especially the budget TVs). I set up piHole to try to prevent this but nothing

I get uncomfortable how this is probably true with all these smart TVs as well (especially the budget TVs). I set up piHole to try to prevent this but nothing stops it from phoning home via a direct IP. It sucks because all our electronics get poisoned since good brands get squashed out by these low cost alternatives that consumers love at the expense of privacy that no one cares about anymore. Also, another crazy thing is ISP provided routers. I was unable to change the DNS on my modem/router, let alone change the security settings.

1vuio0pswjnm7 6y ago
What gateway is the TV using? You can put your own router in front of the ISP one, and set your computers including your TV to use your router as the gateway, not the ISP one. Relying 100% on a third party router (where you do not control the OS) is similar relying 100% on a third party DNS provider (many PiHoles are set up to use third party DNS providers). This is willingly delegating 100% control to a third party. Some of that control can be retained if desired by using own router (with OS you can fully control), or in the case of DNS by using own DNS that you can fully control.
- syntaxing 6y ago
  I had to put a router in between. So the setup is piHole -> Secondary Router with PiHole as router-wide DNS --> ISP router/modem. I'm kind of tempted to just straight up buy my own modem.
  - 1vuio0pswjnm7 6y ago
    If the ISP charges you a monthly fee for the modem/router (you are "leasing" the modem), and you have been a long-term customer, you may have already paid the full price of the modem; yet you do not own it. Let's say the customer connects their own Wifi router to the ISP modem/router via Ethernet cable. There is no need for the ISP modem/router's Wifi AP. Does the ISP modem/router allow the customer to disable it?
api 6y ago
I dislike a lot of "smart" devices, but off-brand or no-brand IoT and "smart" things are a hard no. I assume these to basically be spies or malware vectors. Even if they're not deliberately malicious I figure there's a good chance they are insecure as hell. I tend to go with US-based companies because they would legally be liable for damages, which would in theory mean they'd be less likely to knowingly ship malware and security disasters.
- lostcolony 6y ago
  Even then, IoT devices are going on their own 'guest' network that none of my own devices are on.
  - mulmen 6y ago
    That's a good idea but it still doesn't protect you from spying. And you'd have to put each device on a different network to prevent them from infecting eachother. That probably also has the side effect of making them basically useless. How do you segregate your smart speaker and your smart lightbulb and your smart TV and still control them from your cell phone?
    - lostcolony 6y ago
      I think you missed something there - Either your devices and hub don't need to be exposed to the net (so why are you even using a router connected to the web?), or they do. If they do, it's because that's how you control them, via the web. If that's the case, it doesn't matter what network your phone is on; command and control is done via the web. Now, in terms of infecting each other, sure. But the point is to keep my data devices and such separate from my IoT devices. Yes, the whole IoT infrastructure may get infected and need a purge, but my goal is to keep infection of those from getting, say, my banking information. And yes, it assumes that the command and control app is reasonably secure, but that's a whole different issue (and one reason why I would rely on Amazon or Alexa as a hub, and not some random no name company).
      - 6y ago
zdware 6y ago
I think there's a way with the more advanced routers to intercept all outgoing DNS queries and redirect them.
- mulmen 6y ago
  That still doesn't help with direct IP communication. You'd have to block all traffic except services you want to interact with. That probably means never getting a firmware update or at least uploading some telemetry when you allow a connection back to the mothership for a firmware update. There's no winning with IoT.
  - gowld 6y ago
    > There's no winning with IoT. There's no winning when a third party controls the lowest-level software of a thing on the internet. That includes your general purpose computers. Unless you are the owner of the signing keys down to the bottom of the stack, your system can be remote-controlled.
  - jrcii 6y ago
    It's called a network tap, or port mirroring.
- iso947 6y ago
  Not with DOH
chaostheory 6y ago
Why not just leave them disconnected and use brand name TV streaming boxes instead?
p1necone 6y ago
The fix for this is to just never ever connect your TV to the internet. Devices like the chromecast and game consoles generally have better app support and usability than most smart tvs anyway. It doesn't make sense to tie the lifespan of a display to the lifespan of software support when the computing hardware is so ubiquitous outside of the TV anyway.
- gowld 6y ago
  This won't stop Whispernet-style LTE communications.
  - jsizzle 6y ago
    True but they won’t have lateral access to your local network nor would you be entering credentials to online services.
  - paranoidrobot 6y ago
    I would be surprised if consumer home electronics like this would be shipped with anything other than bluetooth/wifi radios. While the advertising / data sharing revenue is valuable to them, the vast majority of those are going into homes where they're going to be internet connected already. The cost of a modem + service fees for it wouldn't be worth it for most of them. Amazon is starting to ship their Sidewalk protocol[1] which will be embedded into a bunch of their devices - but that seems to be mainly for low-power/remote devices to connect back to a Sidewalk access point, rather than to provide an alternative data-path for (say) customer metrics. [1] https://www.amazon.com/Amazon-Sidewalk/ https://www.amazon.com/Amazon-Sidewalk/
    - daniellarusso 6y ago
      One of the driving forces is for every device to have a 5G connection, no wifi needed. Everything will have an IPv6 address soon. I do not agree with any of that, though.
      - 6y ago
mrfusion 6y ago
You can just keep a smart tv off the internet, no? By a stand-alone Roku for apps?
- quickthrowman 6y ago
  Roku also sells your data, same with Google and likely Amazon. Apple TV is what you want if you don’t want to have your data/viewing habits sold to outside companies.
  - OJFord 6y ago
    ... and then to exclusively watch things bought rented from the i/Tunes/Apple Store? YouTube or Netflix or whatever can still do whatever they want with your 'viewing habits'.
- xodice 6y ago
  Roku's are no better. The top device on my network being blocked from reaching it's mothership are my Roku devices. This is the top analytics from my NextDNS console for the past two weeks: scribe.logs.roku.com 417,115 stats.gc.apple.com 24,752 ssl.google-analytics.com 16,178 track.sr.roku.com 7,534 Roku is easily on the top of my list on spying devices on my network. The Apple ones, while still worrying, are on a network with tons of Apple devices between phones, MacBooks, watches, iPads, etc whereas there are three Roku's making all that traffic.
merb 6y ago
> I set up piHole to try to prevent this but nothing stops it from phoning home via a direct IP. what exactly do you mean? I tought piHole sits "between" the tv and your modem? I mean it probably can easily firewall those ips. Edit: nvm PiHole is only a dns thingy.
- paranoidrobot 6y ago
  PiHole is for DNS blocking. So if say your TV calls out to backdoor.example.com - then PiHole can block it. If instead it calls out to 1.2.3.4 (i.e no DNS lookup) - then PiHole won't block it for you, you'd have to instead set up controls on the firewall/router/etc to filter traffic.
  - pixl97 6y ago
    Just wait till all the smart devices come with a preloaded DoT/DoH list.
    - shagie 6y ago
      That would be this thread - https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2RQNP84fBclI0/ https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2R... and this post https://news.ycombinator.com/item?id=19170671 https://news.ycombinator.com/item?id=19170671
  - rasz 6y ago
    recycling my comment from Mozilla DoH story: Wanted: Firewall blocking all traffic directed at IP addresses not obtained from OS DNS resolver. aka dynamic application level FQDN Egress Filtering. Mayor Cloud providers (aws, azure) and bigger firewalls (fortinet, cisco, paloalto) already offer ~half of what I want. I want a little deamon that listens for DNS queries/replies and modifies firewall rules accordingly.
- daniellarusso 6y ago
  Also, the other risk is the device not respecting what your router says to use for the DNS server. So, it could still bypass piHole and still resolve hostnames.
hvaoc 6y ago
Don’t connect you TV to the network, use a computer or Apple TV instead.
ksec 6y ago
That is precisely the reason why I want ( or I once want ) Apple to make an TV set and not a TV Box. Their Brand, software and UX could create enough value for consumer to buy and set the standard for TV industry. Or someone to create a standard where the Panel is now working more like a Monitor and All electronics are into a separate box.
- wil421 6y ago
  It’s called an Apple TV. You can buy any TV just don’t connect the TV to the internet.
DEADBEEFC0FFEE 6y ago
Yes, TCL TVs are largely venerable.
- jeanofthedead 6y ago
  *vulnerable
m463 6y ago
I hate the ISP router thing. AT&T pushed an update that added an "Application Statistics" page to the router which keeps track of ports and sites visited and is basically hostile to privacy. thing is - this is a rented router, so what can the customer do? Also every time they push an update wifi turns itself back on. So I go in and disable it and then I get a giant warning email "AT&T wifi gateway settings updated".
LdSGSgvupDV 6y ago
This is also true for almost all of devices which could connect to internet. We need a portable small router with firewall feature which could physically ban the specific IPs or domains. For example, iOS to Apple, mac to Apple, Win10 to MS, etc. These connections are much difficult to ban nowadays. What we could do might be limiting their upstream connection via physical firewall router with built-in good web-based GUI.
m-p-3 6y ago
Seriously, I wish TVs stuck to being a dumb display with a modular computer that you can swap or simply pull out if you don't trust it.

1vuio0pswjnm7 6y ago

What gateway is the TV using? You can put your own router in front of the ISP one, and set your computers including your TV to use your router as the gateway, not the ISP one. Relying 100% on a third party router (where you do not control the OS) is similar relying 100% on a third party DNS provider (many PiHoles are set up to use third party DNS providers). This is willingly delegating 100% control to a third party. Some of that control can be retained if desired by using own router (with OS you can fully control), or in the case of DNS by using own DNS that you can fully control.

syntaxing 6y ago
I had to put a router in between. So the setup is piHole -> Secondary Router with PiHole as router-wide DNS --> ISP router/modem. I'm kind of tempted to just straight up buy my own modem.
- 1vuio0pswjnm7 6y ago
  If the ISP charges you a monthly fee for the modem/router (you are "leasing" the modem), and you have been a long-term customer, you may have already paid the full price of the modem; yet you do not own it. Let's say the customer connects their own Wifi router to the ISP modem/router via Ethernet cable. There is no need for the ISP modem/router's Wifi AP. Does the ISP modem/router allow the customer to disable it?

api 6y ago

I dislike a lot of "smart" devices, but off-brand or no-brand IoT and "smart" things are a hard no. I assume these to basically be spies or malware vectors. Even if they're not deliberately malicious I figure there's a good chance they are insecure as hell. I tend to go with US-based companies because they would legally be liable for damages, which would in theory mean they'd be less likely to knowingly ship malware and security disasters.

lostcolony 6y ago
Even then, IoT devices are going on their own 'guest' network that none of my own devices are on.
- mulmen 6y ago
  That's a good idea but it still doesn't protect you from spying. And you'd have to put each device on a different network to prevent them from infecting eachother. That probably also has the side effect of making them basically useless. How do you segregate your smart speaker and your smart lightbulb and your smart TV and still control them from your cell phone?
  - lostcolony 6y ago
    I think you missed something there - Either your devices and hub don't need to be exposed to the net (so why are you even using a router connected to the web?), or they do. If they do, it's because that's how you control them, via the web. If that's the case, it doesn't matter what network your phone is on; command and control is done via the web. Now, in terms of infecting each other, sure. But the point is to keep my data devices and such separate from my IoT devices. Yes, the whole IoT infrastructure may get infected and need a purge, but my goal is to keep infection of those from getting, say, my banking information. And yes, it assumes that the command and control app is reasonably secure, but that's a whole different issue (and one reason why I would rely on Amazon or Alexa as a hub, and not some random no name company).
    - 6y ago

zdware 6y ago

I think there's a way with the more advanced routers to intercept all outgoing DNS queries and redirect them.

mulmen 6y ago
That still doesn't help with direct IP communication. You'd have to block all traffic except services you want to interact with. That probably means never getting a firmware update or at least uploading some telemetry when you allow a connection back to the mothership for a firmware update. There's no winning with IoT.
- gowld 6y ago
  > There's no winning with IoT. There's no winning when a third party controls the lowest-level software of a thing on the internet. That includes your general purpose computers. Unless you are the owner of the signing keys down to the bottom of the stack, your system can be remote-controlled.
- jrcii 6y ago
  It's called a network tap, or port mirroring.
iso947 6y ago
Not with DOH

chaostheory 6y ago

Why not just leave them disconnected and use brand name TV streaming boxes instead?

p1necone 6y ago

The fix for this is to just never ever connect your TV to the internet. Devices like the chromecast and game consoles generally have better app support and usability than most smart tvs anyway. It doesn't make sense to tie the lifespan of a display to the lifespan of software support when the computing hardware is so ubiquitous outside of the TV anyway.

gowld 6y ago
This won't stop Whispernet-style LTE communications.
- jsizzle 6y ago
  True but they won’t have lateral access to your local network nor would you be entering credentials to online services.
- paranoidrobot 6y ago
  I would be surprised if consumer home electronics like this would be shipped with anything other than bluetooth/wifi radios. While the advertising / data sharing revenue is valuable to them, the vast majority of those are going into homes where they're going to be internet connected already. The cost of a modem + service fees for it wouldn't be worth it for most of them. Amazon is starting to ship their Sidewalk protocol[1] which will be embedded into a bunch of their devices - but that seems to be mainly for low-power/remote devices to connect back to a Sidewalk access point, rather than to provide an alternative data-path for (say) customer metrics. [1] https://www.amazon.com/Amazon-Sidewalk/ https://www.amazon.com/Amazon-Sidewalk/
  - daniellarusso 6y ago
    One of the driving forces is for every device to have a 5G connection, no wifi needed. Everything will have an IPv6 address soon. I do not agree with any of that, though.
    - 6y ago

mrfusion 6y ago

You can just keep a smart tv off the internet, no? By a stand-alone Roku for apps?

quickthrowman 6y ago
Roku also sells your data, same with Google and likely Amazon. Apple TV is what you want if you don’t want to have your data/viewing habits sold to outside companies.
- OJFord 6y ago
  ... and then to exclusively watch things bought rented from the i/Tunes/Apple Store? YouTube or Netflix or whatever can still do whatever they want with your 'viewing habits'.
xodice 6y ago
Roku's are no better. The top device on my network being blocked from reaching it's mothership are my Roku devices. This is the top analytics from my NextDNS console for the past two weeks: scribe.logs.roku.com 417,115 stats.gc.apple.com 24,752 ssl.google-analytics.com 16,178 track.sr.roku.com 7,534 Roku is easily on the top of my list on spying devices on my network. The Apple ones, while still worrying, are on a network with tons of Apple devices between phones, MacBooks, watches, iPads, etc whereas there are three Roku's making all that traffic.

merb 6y ago

> I set up piHole to try to prevent this but nothing stops it from phoning home via a direct IP. what exactly do you mean? I tought piHole sits "between" the tv and your modem? I mean it probably can easily firewall those ips. Edit: nvm PiHole is only a dns thingy.

paranoidrobot 6y ago
PiHole is for DNS blocking. So if say your TV calls out to backdoor.example.com - then PiHole can block it. If instead it calls out to 1.2.3.4 (i.e no DNS lookup) - then PiHole won't block it for you, you'd have to instead set up controls on the firewall/router/etc to filter traffic.
- pixl97 6y ago
  Just wait till all the smart devices come with a preloaded DoT/DoH list.
  - shagie 6y ago
    That would be this thread - https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2RQNP84fBclI0/ https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2R... and this post https://news.ycombinator.com/item?id=19170671 https://news.ycombinator.com/item?id=19170671
- rasz 6y ago
  recycling my comment from Mozilla DoH story: Wanted: Firewall blocking all traffic directed at IP addresses not obtained from OS DNS resolver. aka dynamic application level FQDN Egress Filtering. Mayor Cloud providers (aws, azure) and bigger firewalls (fortinet, cisco, paloalto) already offer ~half of what I want. I want a little deamon that listens for DNS queries/replies and modifies firewall rules accordingly.
daniellarusso 6y ago
Also, the other risk is the device not respecting what your router says to use for the DNS server. So, it could still bypass piHole and still resolve hostnames.

hvaoc 6y ago

Don’t connect you TV to the network, use a computer or Apple TV instead.

ksec 6y ago

That is precisely the reason why I want ( or I once want ) Apple to make an TV set and not a TV Box. Their Brand, software and UX could create enough value for consumer to buy and set the standard for TV industry. Or someone to create a standard where the Panel is now working more like a Monitor and All electronics are into a separate box.

wil421 6y ago
It’s called an Apple TV. You can buy any TV just don’t connect the TV to the internet.

DEADBEEFC0FFEE 6y ago

Yes, TCL TVs are largely venerable.

jeanofthedead 6y ago
*vulnerable

m463 6y ago

I hate the ISP router thing. AT&T pushed an update that added an "Application Statistics" page to the router which keeps track of ports and sites visited and is basically hostile to privacy. thing is - this is a rented router, so what can the customer do? Also every time they push an update wifi turns itself back on. So I go in and disable it and then I get a giant warning email "AT&T wifi gateway settings updated".

LdSGSgvupDV 6y ago

This is also true for almost all of devices which could connect to internet. We need a portable small router with firewall feature which could physically ban the specific IPs or domains. For example, iOS to Apple, mac to Apple, Win10 to MS, etc. These connections are much difficult to ban nowadays. What we could do might be limiting their upstream connection via physical firewall router with built-in good web-based GUI.

m-p-3 6y ago

Seriously, I wish TVs stuck to being a dumb display with a modular computer that you can swap or simply pull out if you don't trust it.