3 ms·

So, once upon a time, nothing emitted or depended on receiving EM waves. Then, we learned how to use electricity and started putting it into everything. Then,

So, once upon a time, nothing emitted or depended on receiving EM waves. Then, we learned how to use electricity and started putting it into everything. Then, and only then, did we start developing government regulation to make sure that your new device for sale didn't broadcast EM waves that interfered with any other devices in the vicinity. We are getting to the point where we will need an Underwriter Labs-style independent body to say, to anybody selling an internet-connected device, "your device is not secure enough to be sold; you are forbidden to sell it until you get your security house in order". This wouldn't solve every problem, but it would solve a lot of it, simply because the cost required to pay for good security would cause most IoT devices that don't really need it, to get rid of it, in order to cut cost and reduce time to market. Only if it if really added a lot of value would the maker be willing to pay for good security; that does not include most IoT today.

soared 6y ago
I completely agree, and would love to see a body to audit the "if your server goes down, what behavior does your device default to?" situation. That would ensure my smart front door lock doesn't default to always-locked, or always-unlocked.
ohazi 6y ago
For appliances as they're currently developed (completely locked down, firmware infrastructure owned and operated by the manufacturer), this definitely seems like a good idea. I do think there's a fine line to walk between these devices and "general purpose computer"-type devices though, and I'd worry about this at least a little bit given the trend that appliance-type devices seem to be taking over the world (especially if you include phones). Separately, I do still want to see a UEFI-style secure boot architecture for appliances. An appliance can have a default mode where it only accepts firmware signed by the manufacturer. But then if a user wants to install their own key and load their own firmware (because the manufacturer has stopped supporting the device, has gone out of business, writes shitty firmware, or just to use hardware that they own in a different way), most devices should make this possible, and it would be interesting to think about what a legal requirement would look like here. A manufacturer could gate access via a configuration menu, or by cutting a trace/jumper or with a write protect screw like on Chromebooks. And you could have entire classes of devices where open access is explicitly not allowed, like medical devices. But smart speakers? Manufacturers should not be allowed to cryptographically guarantee that they become trash after two years.

soared 6y ago

I completely agree, and would love to see a body to audit the "if your server goes down, what behavior does your device default to?" situation. That would ensure my smart front door lock doesn't default to always-locked, or always-unlocked.

ohazi 6y ago

For appliances as they're currently developed (completely locked down, firmware infrastructure owned and operated by the manufacturer), this definitely seems like a good idea. I do think there's a fine line to walk between these devices and "general purpose computer"-type devices though, and I'd worry about this at least a little bit given the trend that appliance-type devices seem to be taking over the world (especially if you include phones). Separately, I do still want to see a UEFI-style secure boot architecture for appliances. An appliance can have a default mode where it only accepts firmware signed by the manufacturer. But then if a user wants to install their own key and load their own firmware (because the manufacturer has stopped supporting the device, has gone out of business, writes shitty firmware, or just to use hardware that they own in a different way), most devices should make this possible, and it would be interesting to think about what a legal requirement would look like here. A manufacturer could gate access via a configuration menu, or by cutting a trace/jumper or with a write protect screw like on Chromebooks. And you could have entire classes of devices where open access is explicitly not allowed, like medical devices. But smart speakers? Manufacturers should not be allowed to cryptographically guarantee that they become trash after two years.