6 ms·

You might be getting a bit too far ahead of where the industry is at with some of those wishlist items. NIST's requirements are things that are best practices

You might be getting a bit too far ahead of where the industry is at with some of those wishlist items. NIST's requirements are things that are best practices that everyone agrees with, like: * data stored/transmitted is secured by some kind of means * the device supports software updates * the device requires users to authenticate * the device has documentation * you can report security vulnerabilities to the developer And even these are things that many devices fail to do, today. We gotta get the basics fixed first. But for now, you can presume the Netflix button on your TV remote can't be configured to point to an alternative API if Netflix goes away. :)

vessenes 2y ago
Oh, I'm with you 100%. The labels for my list will all be like black with a big X through them. But I propose consumer behavior has a better shot of changing with labels.
saltminer 2y ago
> But for now, you can presume the Netflix button on your TV remote can't be configured to point to an alternative API if Netflix goes away. :) At least for Android TV devices, Button Mapper works for some. https://play.google.com/store/apps/details?id=flar2.homebutton https://play.google.com/store/apps/details?id=flar2.homebutt...
- extraduder_ire 2y ago
  Whoever made the decision to make Intents work the way they do on Android made a really good choice. It's remarkable how much you can customize and replace different pieces of software on an android device.
rkagerer 2y ago
the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which in a sense are similarly 'read-only').
- moritonal 2y ago
  An interesting thought is how when devices couldn't auto-update, they had to work out the gate. I imagine this encouraged companies to do much better testing to reach a gold-plate before deploying.
  - jonhohle 2y ago
    Less critical, but video games are the same way. Companies will press and ship discs with known broken games and then issue a patch of dozens of GBs day one. The whole point of having a disc is when all the servers are off line, and the store have shut down, the game is still playable.
  - helsinkiandrew 2y ago
    Assuming these are network devices - it can be harder to certify future working if the network services they rely on become unavailable or when the failure only occurs at scale. Case in point when 700,000 Netgear routers pinged the University of Wisconsin–Madison NTP server (harcoded IP address) every second. https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Netgear_and_the_University_of_Wisconsin%E2%80%93Madison https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Ne...
  - kube-system 2y ago
    This is true, but mostly only relevant to the expected user functionality. User acceptance testing in waterfall development doesn't often identify security vulnerabilities.
  - rkagerer 2y ago
    Agree wholeheartedly. Seems like nearly everyone seems to "cheat" these days and ship well before the product is remotely finished.
- ocdtrekkie 2y ago
  Yep! My Insteon home automation devices have no firmware update capabilities. They also have an extremely simple local RF protocol. They allow smart device behavior but are too stupid to be "compromised".
TeMPOraL 2y ago
The software update angle has already been commented on, but I'm not sure this one is a good idea either: > the device requires users to authenticate
- kube-system 2y ago
  No, it is a good idea. If someone is operating or changing settings on your baby monitor, doorbell camera, garage door opener, smart switch, light bulb, etc -- the developer should check to make sure that the actor doing so is authorized to do it. Why in the world would anyone want unauthenticated access to these devices?
  - ndriscoll 2y ago
    All of those things might have a authentication-free use-case for e.g. a babysitter (maybe not to change settings, but to use). For personal networks, being on your local LAN is in practice a decent form of authentication given the tradeoffs of otherwise having to manage credentials.
    - kube-system 2y ago
      That seems a bit contrived. I would expect my babysitter to be observing a child in-person, not remotely. Regardless, the commonly expected use case for IoT devices is for people to be able to access them from their mobile device, on the internet (thus the 'I' in IoT). IoT devices, as their name implies, are on the internet, and need authentication because of this. The problem is that this use case is real, and people are buying these devices, and so, how do we make them better? "Just don't do that" doesn't address the problem, it's a dismissal of it.
      - ndriscoll 2y ago
        We use a camera in our daughter's nursery to see whether she's going to fall asleep (if protesting a nap/bed time after laying her down) or whether she's standing in her crib/too wound up. We also use it to keep track of whether she's woken up if we're out in the yard. I do actually have the ability to access it over the Internet through wireguard, but that's something I never need. LAN access suffices. IoT is a marketing term. Networked devices don't necessarily need to use the Internet, and indeed most of the time there isn't even a use-case. You're going to open your garage while you're at the store? Honestly I don't see the use-case for almost any IoT thing though. It mostly seems like gimmicks (color changing/dimming lights) or adding unnecessary complications that make it less secure and more failure prone so that someone can sell you a service (a cloud app for your garage instead of a remote/keypad, an app for your door instead of a key).
godelski 2y ago
> But for now, you can presume the Netflix button on your TV remote can't be configured to point to an alternative API if Netflix goes away. :) It is HackerNews, so your statement is true UNLESS you're willing to hack your TV. (But this shouldn't be a thing people _have_ to do... ): Warning, I haven't personally tried this https://askanydifference.com/how-to-root-samsung-tv/ https://askanydifference.com/how-to-root-samsung-tv/ https://wiki.samygo.tv/index.php?title=SamyGO_for_DUMMIES https://wiki.samygo.tv/index.php?title=SamyGO_for_DUMMIES

vessenes 2y ago

Oh, I'm with you 100%. The labels for my list will all be like black with a big X through them. But I propose consumer behavior has a better shot of changing with labels.

saltminer 2y ago

> But for now, you can presume the Netflix button on your TV remote can't be configured to point to an alternative API if Netflix goes away. :) At least for Android TV devices, Button Mapper works for some. https://play.google.com/store/apps/details?id=flar2.homebutton https://play.google.com/store/apps/details?id=flar2.homebutt...

extraduder_ire 2y ago
Whoever made the decision to make Intents work the way they do on Android made a really good choice. It's remarkable how much you can customize and replace different pieces of software on an android device.

rkagerer 2y ago

the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which in a sense are similarly 'read-only').

moritonal 2y ago
An interesting thought is how when devices couldn't auto-update, they had to work out the gate. I imagine this encouraged companies to do much better testing to reach a gold-plate before deploying.
- jonhohle 2y ago
  Less critical, but video games are the same way. Companies will press and ship discs with known broken games and then issue a patch of dozens of GBs day one. The whole point of having a disc is when all the servers are off line, and the store have shut down, the game is still playable.
- helsinkiandrew 2y ago
  Assuming these are network devices - it can be harder to certify future working if the network services they rely on become unavailable or when the failure only occurs at scale. Case in point when 700,000 Netgear routers pinged the University of Wisconsin–Madison NTP server (harcoded IP address) every second. https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Netgear_and_the_University_of_Wisconsin%E2%80%93Madison https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Ne...
- kube-system 2y ago
  This is true, but mostly only relevant to the expected user functionality. User acceptance testing in waterfall development doesn't often identify security vulnerabilities.
- rkagerer 2y ago
  Agree wholeheartedly. Seems like nearly everyone seems to "cheat" these days and ship well before the product is remotely finished.
ocdtrekkie 2y ago
Yep! My Insteon home automation devices have no firmware update capabilities. They also have an extremely simple local RF protocol. They allow smart device behavior but are too stupid to be "compromised".

TeMPOraL 2y ago

The software update angle has already been commented on, but I'm not sure this one is a good idea either: > the device requires users to authenticate

kube-system 2y ago
No, it is a good idea. If someone is operating or changing settings on your baby monitor, doorbell camera, garage door opener, smart switch, light bulb, etc -- the developer should check to make sure that the actor doing so is authorized to do it. Why in the world would anyone want unauthenticated access to these devices?
- ndriscoll 2y ago
  All of those things might have a authentication-free use-case for e.g. a babysitter (maybe not to change settings, but to use). For personal networks, being on your local LAN is in practice a decent form of authentication given the tradeoffs of otherwise having to manage credentials.
  - kube-system 2y ago
    That seems a bit contrived. I would expect my babysitter to be observing a child in-person, not remotely. Regardless, the commonly expected use case for IoT devices is for people to be able to access them from their mobile device, on the internet (thus the 'I' in IoT). IoT devices, as their name implies, are on the internet, and need authentication because of this. The problem is that this use case is real, and people are buying these devices, and so, how do we make them better? "Just don't do that" doesn't address the problem, it's a dismissal of it.
    - ndriscoll 2y ago
      We use a camera in our daughter's nursery to see whether she's going to fall asleep (if protesting a nap/bed time after laying her down) or whether she's standing in her crib/too wound up. We also use it to keep track of whether she's woken up if we're out in the yard. I do actually have the ability to access it over the Internet through wireguard, but that's something I never need. LAN access suffices. IoT is a marketing term. Networked devices don't necessarily need to use the Internet, and indeed most of the time there isn't even a use-case. You're going to open your garage while you're at the store? Honestly I don't see the use-case for almost any IoT thing though. It mostly seems like gimmicks (color changing/dimming lights) or adding unnecessary complications that make it less secure and more failure prone so that someone can sell you a service (a cloud app for your garage instead of a remote/keypad, an app for your door instead of a key).

godelski 2y ago

> But for now, you can presume the Netflix button on your TV remote can't be configured to point to an alternative API if Netflix goes away. :) It is HackerNews, so your statement is true UNLESS you're willing to hack your TV. (But this shouldn't be a thing people _have_ to do... ): Warning, I haven't personally tried this https://askanydifference.com/how-to-root-samsung-tv/ https://askanydifference.com/how-to-root-samsung-tv/ https://wiki.samygo.tv/index.php?title=SamyGO_for_DUMMIES https://wiki.samygo.tv/index.php?title=SamyGO_for_DUMMIES