4 ms·

I disagree that there are better ways to transmit data p2p in most devices. Even the smoothest of setups for things like iot devices usually require a Bluetooth

by jjeaff 4y ago

I disagree that there are better ways to transmit data p2p in most devices. Even the smoothest of setups for things like iot devices usually require a Bluetooth connection with a passcode or a connection to a lone wifi signal after which you need to switch back. Using sound would be a perfect way to setup iot speakers or really anything close by. Instead of having to activate Bluetooth pairing and find the sometimes strangely named device among the dozen or so devices that inevitably show up, ultrasound would be a great way to transmit the initial credentials.

hgomersall 4y ago
The key exchange problem doesn't go away because you're using ultrasound.
- kevin_nisbet 4y ago
  Correct, although it's not that it goes away, more of a it has different properties. The short time I worked in the IOT space, I was a big proponent of exploring an option like this for bootstrapping the WIFI connection in a device that otherwise had just a button or two. The basic problem is, the wifi password needs to be shared with a device without an interface. The traditional method at the time was the device boots with an unsecured wireless network. And an app on the phone is used to connect to the network, and share the wifi password, and then rendezvous on the wifi network to continue provisioning. I think there are some protocols for this that I don't fully remember now. There's lots to consider in this method, such as can someone sniff the transfer, how is that protected, what is the range to pick up, etc. Can someone trick the app into connecting to some other device, etc, etc. If you put mitigations in, how can those be countered. With sound / ultrasound based provisioning (the device I'm talking about already had a microphone and speaker), the range is more limited to who can hear the device. The signal strength is much weaker, an eavesdropper might need to be in the same room. This might allow weaknesses in the overall model of key exchange to be less of a concern, as the properties change to something a lot harder to intercept.
  - hgomersall 4y ago
    It feels to be that this is better solved with NFC. The hardware is in principle cheaper with NFC (certainly, cheaper transducers) and my understanding is nfc is more robust to snoopers - certainly ultrasound is explicitly broadcast.
    - baybal2 4y ago
    - kevin_nisbet 4y ago
      When I worked on this was a few years ago, so NFC wasn't a viable option at the time. I think even today, some research would need to be done on how widespread support is, we can't guarantee everyone has a brand new phone. but I agree NFC would be worth serious consideration now. When considering robustness of support, one nice thing about the WIFI approach is in theory you can fall back to just a web browser. So basically any device could be used for provisioning. And the audio method, would probably support a great set of devices. We didn't actually consider ultrasonic, just an audio codec that was in use at the time and doesn't sound awful.
Auracle 4y ago
I’m kind of bummed nobody has copied how they transfer files on The Expanse. For those that haven’t watched, if someone is standing across from you, you simply swipe it to them. I feel like Apple’s ‘Find my’ tech could work to get positional data and make it possible. You’d need whitelists and the like of course.
- nvahalik 4y ago
  AirDrop is what you're looking for. The issue at play here is that most devices have no concept of locality or relative positioning. They may know (at best) approximate distance between itself and another device based on the type of transmission, signal level, noise levels, etc. Phones also can't understand intent. How does it know whether it doesn't mean the person sitting behind your friend or your friend?
  - Auracle 4y ago
    I use AirDrop and it works well, but it's still not seamless. I think there would still be a quick confirmation button listing who owns what phone you're sending it to, and it could default to people you know in vague situations - but generally whoever is closer.

by jjeaff 4y ago

hgomersall 4y ago

The key exchange problem doesn't go away because you're using ultrasound.

kevin_nisbet 4y ago
Correct, although it's not that it goes away, more of a it has different properties. The short time I worked in the IOT space, I was a big proponent of exploring an option like this for bootstrapping the WIFI connection in a device that otherwise had just a button or two. The basic problem is, the wifi password needs to be shared with a device without an interface. The traditional method at the time was the device boots with an unsecured wireless network. And an app on the phone is used to connect to the network, and share the wifi password, and then rendezvous on the wifi network to continue provisioning. I think there are some protocols for this that I don't fully remember now. There's lots to consider in this method, such as can someone sniff the transfer, how is that protected, what is the range to pick up, etc. Can someone trick the app into connecting to some other device, etc, etc. If you put mitigations in, how can those be countered. With sound / ultrasound based provisioning (the device I'm talking about already had a microphone and speaker), the range is more limited to who can hear the device. The signal strength is much weaker, an eavesdropper might need to be in the same room. This might allow weaknesses in the overall model of key exchange to be less of a concern, as the properties change to something a lot harder to intercept.
- hgomersall 4y ago
  It feels to be that this is better solved with NFC. The hardware is in principle cheaper with NFC (certainly, cheaper transducers) and my understanding is nfc is more robust to snoopers - certainly ultrasound is explicitly broadcast.
  - baybal2 4y ago
  - kevin_nisbet 4y ago
    When I worked on this was a few years ago, so NFC wasn't a viable option at the time. I think even today, some research would need to be done on how widespread support is, we can't guarantee everyone has a brand new phone. but I agree NFC would be worth serious consideration now. When considering robustness of support, one nice thing about the WIFI approach is in theory you can fall back to just a web browser. So basically any device could be used for provisioning. And the audio method, would probably support a great set of devices. We didn't actually consider ultrasonic, just an audio codec that was in use at the time and doesn't sound awful.

Auracle 4y ago

I’m kind of bummed nobody has copied how they transfer files on The Expanse. For those that haven’t watched, if someone is standing across from you, you simply swipe it to them. I feel like Apple’s ‘Find my’ tech could work to get positional data and make it possible. You’d need whitelists and the like of course.

nvahalik 4y ago
AirDrop is what you're looking for. The issue at play here is that most devices have no concept of locality or relative positioning. They may know (at best) approximate distance between itself and another device based on the type of transmission, signal level, noise levels, etc. Phones also can't understand intent. How does it know whether it doesn't mean the person sitting behind your friend or your friend?
- Auracle 4y ago
  I use AirDrop and it works well, but it's still not seamless. I think there would still be a quick confirmation button listing who owns what phone you're sending it to, and it could default to people you know in vague situations - but generally whoever is closer.