3 ms·
It needs not have a full-blown PKI/TLS stack. In fact it does not need the encryption, it only needs authentication of the exchange and the replay protection. T
by eps 15y ago
It needs not have a full-blown PKI/TLS stack. In fact it does not need the encryption, it only needs authentication of the exchange and the replay protection. These are as simple as numbering messages with increasing IDs and HMAC'ing them with pre-shared key (that in turn can be generated on one side and passed to another during the pairing sequence). This is cheap in terms of CPU usage.
I doubt the lack of security provisions is due to the $ matters. It is far more likely to be just the developers' ignorance on the subject... which is entirely unsurprising, totally agree here.
- Jach 15y agoHow many "see, capitalism makes people take short cuts!" can be explained better by "the company was just ignorant about this case"?
- Groxx 15y agoHow many ignorance cases can be explained better by delegation in the face of cost? They're essentially one and the same most of the time - unlimited time / money lets you be infinitely careful, but you have competitors. But yes, capitalism tends to encourage people to make cuts where they will be least noticed - like this one, until one person got it in their head that they might be hackable. They were fine for years prior to that occurrence.
- sp332 15y agoThe money isn't so much in the chips in the device, so much as the people and time to develop it and test it.