3 ms·

I appreciate the input, but device and backend are nearly complete. I'm looking for concrete examples of how other people manage x509 certs.

banana_giraffe 6y ago
Generally it involves some answer that doesn't wait till the device and backend are nearly complete. Security shouldn't be the last step of your equation. Snark aside, there are lots of white papers on x509 provision of devices, including IoT devices. Go read them.
- Igelau 6y ago
  Built the product. No idea about best practices. Didn't read the white papers. Security built at the last minute by asking strangers on the Internet. IoT security/privacy concerns in a nutshell.
  - mkr-hn 6y ago
    On the plus side everyone who comes across this subthread will have it in mind the next time a friend talks about this great IoT idea they have. Better culture starts at the bottom with one person sharing a thought with another.
    - coupdejarnac 6y ago
      It's a shining example of snark, condescension, and second guessing someone's use case. Better culture starts elsewhere.
      - mkr-hn 6y ago
        You've gone off on several people now who got the exact same impression rather than accept maybe you're not a flawless communicator. You can't expect more charitable reads from others if you're not willing to be the first to give others the benefit of the doubt. This lashing out is definitely not going to convince people you thought about security in advance.
  - coupdejarnac 6y ago
    Excuse me, asshole. I've read plenty on the subject and spent significant resources on security, but I'm curious what other people here are doing. I don't appreciate all the snark.
    - Igelau 6y ago
      > Excuse me, asshole. You're excused. > I don't appreciate all the snark. The article is a slam on the next generation of IoT devices. You might call it "snark" because you saw the word in The Guidelines, but it's healthy skepticism that's well on-topic for the thread. IoT encroachment is concerning and annoying for many of us. But good luck with your widget. Don't be a fool with your user's data. Let them use it in "dumb" mode. And thanks for giving me an excuse to read about the dueling exploits of Guy Chabot, Baron de Jarnac. With Love, Asshole
      - deleted 6y ago
        [deleted]
    - dang 6y ago
      You broke the HN guidelines badly in this thread. We ban accounts that do that. The rules apply regardless of whether other users are breaking them, how bad their comments are, or how bad you feel they are. We've also had to ask you not to break the site guidelines before. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here—all of them, please—we'd be grateful.
- coupdejarnac 6y ago
  I really don't appreciate this response. Perhaps I've been overly brief about the background of the product's development, but a lot of effort has been put into security. I've read lots of documents about x509 provisioning. I am curious what people here are doing. Telling me to go read white papers is garbage response.
judge2020 6y ago
AWS/GCP/Twilio/etc IoT or almost any other managed IoT service is going to be good for securing devices by only making outbound connections instead of accepting inbound ones. This reduces the attack surface to 'taking over an AWS account', ie. the Ubiquiti hack, which is better than regular IoT devices which have random UPnP-broadcasted open ports and, if they don't have reliable automatic updates, means vulnerability become the next target of a 0.0.0.0/0 network scan.
adrianN 6y ago
Make the device accessible over a TOR hidden service only https://blog.torproject.org/quick-simple-guide-tor-and-internet-things-so-far https://blog.torproject.org/quick-simple-guide-tor-and-inter...

banana_giraffe 6y ago

Generally it involves some answer that doesn't wait till the device and backend are nearly complete. Security shouldn't be the last step of your equation. Snark aside, there are lots of white papers on x509 provision of devices, including IoT devices. Go read them.

Igelau 6y ago
Built the product. No idea about best practices. Didn't read the white papers. Security built at the last minute by asking strangers on the Internet. IoT security/privacy concerns in a nutshell.
- mkr-hn 6y ago
  On the plus side everyone who comes across this subthread will have it in mind the next time a friend talks about this great IoT idea they have. Better culture starts at the bottom with one person sharing a thought with another.
  - coupdejarnac 6y ago
    It's a shining example of snark, condescension, and second guessing someone's use case. Better culture starts elsewhere.
    - mkr-hn 6y ago
      You've gone off on several people now who got the exact same impression rather than accept maybe you're not a flawless communicator. You can't expect more charitable reads from others if you're not willing to be the first to give others the benefit of the doubt. This lashing out is definitely not going to convince people you thought about security in advance.
- coupdejarnac 6y ago
  Excuse me, asshole. I've read plenty on the subject and spent significant resources on security, but I'm curious what other people here are doing. I don't appreciate all the snark.
  - Igelau 6y ago
    > Excuse me, asshole. You're excused. > I don't appreciate all the snark. The article is a slam on the next generation of IoT devices. You might call it "snark" because you saw the word in The Guidelines, but it's healthy skepticism that's well on-topic for the thread. IoT encroachment is concerning and annoying for many of us. But good luck with your widget. Don't be a fool with your user's data. Let them use it in "dumb" mode. And thanks for giving me an excuse to read about the dueling exploits of Guy Chabot, Baron de Jarnac. With Love, Asshole
    - deleted 6y ago
      [deleted]
  - dang 6y ago
    You broke the HN guidelines badly in this thread. We ban accounts that do that. The rules apply regardless of whether other users are breaking them, how bad their comments are, or how bad you feel they are. We've also had to ask you not to break the site guidelines before. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here—all of them, please—we'd be grateful.
coupdejarnac 6y ago
I really don't appreciate this response. Perhaps I've been overly brief about the background of the product's development, but a lot of effort has been put into security. I've read lots of documents about x509 provisioning. I am curious what people here are doing. Telling me to go read white papers is garbage response.

judge2020 6y ago

AWS/GCP/Twilio/etc IoT or almost any other managed IoT service is going to be good for securing devices by only making outbound connections instead of accepting inbound ones. This reduces the attack surface to 'taking over an AWS account', ie. the Ubiquiti hack, which is better than regular IoT devices which have random UPnP-broadcasted open ports and, if they don't have reliable automatic updates, means vulnerability become the next target of a 0.0.0.0/0 network scan.

adrianN 6y ago

Make the device accessible over a TOR hidden service only https://blog.torproject.org/quick-simple-guide-tor-and-internet-things-so-far https://blog.torproject.org/quick-simple-guide-tor-and-inter...