3 ms·

It seems brave to let an IoT device talk to someone over an unencrypted wan though. They're often of pretty varying software quality and rarely updated. If you

It seems brave to let an IoT device talk to someone over an unencrypted wan though. They're often of pretty varying software quality and rarely updated. If you really want IoT wifi devices, put them on a separate wifi, and only let them talk to a local device that you can keep up to date. Assume they're vulnerable to local attacks over wifi and act accordingly, e.g. don't give the IoT wifi access to your other devices beyond to that controller, and definitely not to the wider internet. If they're closed source, assume they're already compromised from the factory

vv_ 2y ago
The issue in IoT is that most people expect to be able to control their IoT (e.g. Smart Home) devices from outside of their network. This requires you to have a central server these devices communicate with or a similar deployment on-premises with a public IP address. I've always wondered how it is economically feasible to run these central services without a monthly subscription. If you stop selling devices you'll go under fairly quickly.
- leptons 2y ago
  I have all my "Tuya" IoT devices on a separate network, isolated from my personal intranet, and the cloud servers these devices talk to are in China. I pay nothing to "Tuya" for their cloud service, never have. If the "Tuya" service ever goes down, my home automation is also down, and that sucks. I'm trying to replace it all with "Tasmota" devices now, but it's not quite as easy or as cheap to do.
- procaryote 2y ago
  Yeah, sadly, people care about convenience and not security. So you get things like this: https://www.malwarebytes.com/blog/news/2024/04/ring-agrees-to-pay-5-6-million-after-cameras-were-used-to-spy-on-customers https://www.malwarebytes.com/blog/news/2024/04/ring-agrees-t... and somehow they are still in business, and popular. If you do care about security, keeping your home-automation within your own control is probably the only sane path. Homeassistant and similar open source things like openhab are pretty good if a bit fiddly, and a wireguard vpn like tailscale a fairly practical way to access it when away from home.
  - vv_ 2y ago
    > If you do care about security, keeping your home-automation within your own control is probably the only sane path. It is also very expensive, so only a minority of informed users would select such a route. Not to mention that it is not trivial to setup. To my knowledge the only company that has decent security practises is Ubiquiti. What the article describes is actually fairly standard in the IoT industry. I'm surprised there have been so few lawsuits.

vv_ 2y ago

The issue in IoT is that most people expect to be able to control their IoT (e.g. Smart Home) devices from outside of their network. This requires you to have a central server these devices communicate with or a similar deployment on-premises with a public IP address. I've always wondered how it is economically feasible to run these central services without a monthly subscription. If you stop selling devices you'll go under fairly quickly.

leptons 2y ago
I have all my "Tuya" IoT devices on a separate network, isolated from my personal intranet, and the cloud servers these devices talk to are in China. I pay nothing to "Tuya" for their cloud service, never have. If the "Tuya" service ever goes down, my home automation is also down, and that sucks. I'm trying to replace it all with "Tasmota" devices now, but it's not quite as easy or as cheap to do.
procaryote 2y ago
Yeah, sadly, people care about convenience and not security. So you get things like this: https://www.malwarebytes.com/blog/news/2024/04/ring-agrees-to-pay-5-6-million-after-cameras-were-used-to-spy-on-customers https://www.malwarebytes.com/blog/news/2024/04/ring-agrees-t... and somehow they are still in business, and popular. If you do care about security, keeping your home-automation within your own control is probably the only sane path. Homeassistant and similar open source things like openhab are pretty good if a bit fiddly, and a wireguard vpn like tailscale a fairly practical way to access it when away from home.
- vv_ 2y ago
  > If you do care about security, keeping your home-automation within your own control is probably the only sane path. It is also very expensive, so only a minority of informed users would select such a route. Not to mention that it is not trivial to setup. To my knowledge the only company that has decent security practises is Ubiquiti. What the article describes is actually fairly standard in the IoT industry. I'm surprised there have been so few lawsuits.