3 ms·

The issue is that a lot of IoT things won't even work unless they have Internet connection and a registered account. The careful approach to IoT is to never co

The issue is that a lot of IoT things won't even work unless they have Internet connection and a registered account. The careful approach to IoT is to never connect a device to anything, dump the firmware, analyze it, reflash the EEPROM with patched TLS certificates (if necessary), write your own server implementation, let the IoT device join a dedicated IoT WiFi network, on that network run everything through a gateway pretending to be "the Internet", where the emulated server is running. Yep, it's this bad. Of course, if the device or its malfunction cannot cause sufficient harm (e.g. it's a light, usually it's not worth to reverse engineer it) then just run it on a separate SSID and VLAN, with least access necessary to get it running (starting from blocking everything and allowing network by network until it works). And, uh, if the device has a LTE or can use something like Amazon Sidewalk, it gets even trickier to keep it tame. I don't have any solar power stuff, but I did this with my old cat feeder machine. In the process I discovered a service/backdoor SSH account, a system that does not encrypt p-frames at all before uploading data to the cloud, and a bunch of other things that made me happy I did not connect it to any public networks. Short conclusion: consider against with a camera or a microphone that runs on Tuya-developed firmware. Generalized conclusion: consider against IoT from any manufacturers you don't trust to fully respect your best interests, or aren't willing to audit first. The downside is obvious, of course. And with every year more and more manufacturers tighten up their hardware, but I'm certain the crappy programming and service backdoors are all there, only ways to mess with the network traffic or firmware are clamped down.

wolrah 2y ago
> The issue is that a lot of IoT things won't even work unless they have Internet connection and a registered account. To a significant extent I see this as a "buyer beware" situation. Now, a lot of people aren't even really aware of the problem nor knowledgeable enough to know what to look for, but I'd expect the majority of the HN audience is both aware of and able to understand the problem enough to be capable of looking out for and avoiding it. I personally don't mind if a device uses internet connectivity to provide a useful service, but I refuse to buy anything that requires internet connectivity arbitrarily for functionality that could easily be performed locally. The first thing I do when I think a new IoT device might be neat is google "<product> Home Assistant" and see what comes up. If there's no integration or the integration is cloud based instead of local I probably won't buy it. IoT devices are not necessities, most of them are either luxury items or disposable novelties. You can always just not buy them. There are certainly some categories, particularly in the residential market, where it may be harder to find an option you find agreeable but its far from impossible. If every major offering in a category is bad in this way, you almost certainly don't actually need that thing.
- drdaeman 2y ago
  > IoT devices are not necessities I wouldn’t go that far. To best of my awareness, there are no good automatic cat feeders on the market - just crappy ones and tolerable ones. This doesn’t mean they’re a some novelty gimmick I don’t really need. I’ve got two cats, one had developed a health condition that requires special diet - and I’d say that a feeders that track consumption and can recognize between two furry assholes and unlock only for the appropriate one, are basically a necessity for me here. Without those I would have to force unnatural feeding schedules on my cats, so I can watch them eating from their own bowls. Even basic stuff like smart lights isn’t totally a gimmick. It’s not just a light with phone for a remote control, after all. Being smart enough to e.g. not blast at full brightness in my eyes if I need something at nighttime is not just a fancy thing, but good for sleeping hygiene.

wolrah 2y ago

> The issue is that a lot of IoT things won't even work unless they have Internet connection and a registered account. To a significant extent I see this as a "buyer beware" situation. Now, a lot of people aren't even really aware of the problem nor knowledgeable enough to know what to look for, but I'd expect the majority of the HN audience is both aware of and able to understand the problem enough to be capable of looking out for and avoiding it. I personally don't mind if a device uses internet connectivity to provide a useful service, but I refuse to buy anything that requires internet connectivity arbitrarily for functionality that could easily be performed locally. The first thing I do when I think a new IoT device might be neat is google "<product> Home Assistant" and see what comes up. If there's no integration or the integration is cloud based instead of local I probably won't buy it. IoT devices are not necessities, most of them are either luxury items or disposable novelties. You can always just not buy them. There are certainly some categories, particularly in the residential market, where it may be harder to find an option you find agreeable but its far from impossible. If every major offering in a category is bad in this way, you almost certainly don't actually need that thing.

drdaeman 2y ago
> IoT devices are not necessities I wouldn’t go that far. To best of my awareness, there are no good automatic cat feeders on the market - just crappy ones and tolerable ones. This doesn’t mean they’re a some novelty gimmick I don’t really need. I’ve got two cats, one had developed a health condition that requires special diet - and I’d say that a feeders that track consumption and can recognize between two furry assholes and unlock only for the appropriate one, are basically a necessity for me here. Without those I would have to force unnatural feeding schedules on my cats, so I can watch them eating from their own bowls. Even basic stuff like smart lights isn’t totally a gimmick. It’s not just a light with phone for a remote control, after all. Being smart enough to e.g. not blast at full brightness in my eyes if I need something at nighttime is not just a fancy thing, but good for sleeping hygiene.