6 ms·
The only reason I feel comfortable connecting things like consumer network-connected cameras, TVs, Bluray players, game consoles, or anything else "Internet Rea
by click170 12y ago
The only reason I feel comfortable connecting things like consumer network-connected cameras, TVs, Bluray players, game consoles, or anything else "Internet Ready" to my network is because I perform outbound filtering, and it's a big eye-opener to see first-hand what these devices are trying to connect to.
Luckily most things use HTTP so you can actually filter based on the URL it's trying to access. For example, permitting software updates, but denying any kind of analytics reporting.
And with VPN on your phone (especially Always-On VPN) you can filter the requests from your phone with the same granularity, which is even more eye-opening.
Outbound filtering is incredibly useful if you value your security and privacy.
- kibwen 12y agoCan you recommend any resources for getting started?
- naiyt 12y agoYeah, I'd also be interested in some resources on outbound filtering your network.
- calgoo 12y agoI currently use a Mikrotik 750GL as my main router to the internet. In it i have a list of static DNS entries to send AD networks, and things like google-stats to a local http server to block the traffic. I also use it to block devices that i can not control from connecting to the internet (this is how i will block any "internet if things" crap). I dont need a internet connection on all the "things" in my house. Also, there is no reason why all these functions should be built into a TV. I believe that the TV should be a monitor and thats it. We dont even need to have a TV tuner anymore. Just add 6 HDMI ports or more and I will add whatever function i want. [Edited]
- click170 12y agoEvery time I say this I feel like a shill because I worked for them briefly, but Sophos has a Home version of their UTM firewall (0). It has pros and cons, but overall I think it's pretty good (even after working there). Some other options include Sonicwall and pfsense, and I encourage others to post their suggestions as well. I haven't used SonicWall, though I have used pfsense strictly as a firewall. (0) http://www.sophos.com/en-us/products/free-tools/sophos-utm-home-edition.aspx http://www.sophos.com/en-us/products/free-tools/sophos-utm-h...
- nl 12y agoAny hardware solution recommendations - or things that will run on a RPi/router? I don't like the idea of having to keep a desktop/laptop computer on 24/7.
- corford 12y agohttps://www.pfsense.org/hardware/#pfsense-store https://www.pfsense.org/hardware/#pfsense-store
- nl 12y agoYeah, I saw that. Not exactly consumer prices are they? Reading the forums there are some dual LAN Atom based mini PCs that seem OK. Edit: Also http://store.netgate.com/Desktop-Systems-C83.aspx http://store.netgate.com/Desktop-Systems-C83.aspx has some preconfigured options at under $300.
- listic 12y agoThose are the same things. If you do not want to financially support pfSense, you can buy hardware from Netgate directly, starting from $299. Even cheaper as a kit or with older hardware, but you decide for yourself whether it will be adequate for you. I'm planning on buying an assembled APU from Netgate for myself; right now I'm using m0n0wall on a separate P3 PC (Celeron 1000), modded for silence. Probably will try out pfSense beforehand, on a separate CF card I just ordered.
- nl 12y agoThe Netgate APU2/APU4 devices don't appear to be available directly from pfsense. They do say money from them goes to pfsense though (and they advertise them on the pfsense site)
- corford 12y agoOpenWRT on a Buffalo WZR-HP-AG300H is a another very nice and cheap solution.
- carlio 12y agoI use Little Snitch for OSX: http://www.obdev.at/products/littlesnitch/index.html http://www.obdev.at/products/littlesnitch/index.html
- baby 12y agoGlasswire: https://news.ycombinator.com/item?id=8222652 https://news.ycombinator.com/item?id=8222652
- chatmasta 12y agoIf anyone wants to build it, I would love a website where you could look up any device/program and see a profile of what data it sends out of your house, or what it brings in. Pair it with an open source app to collect the profiles and upload them to the website (somewhat ironically).
- crazygringo 12y agoYou know, that's a fantastic idea. It's almost analagous to the "nutrition facts" that you get on food. A standard baseline so you can know what's going on.
- harkyns_castle 12y agoMaking the collected data machine readable so it could be sucked into snort/firewall rules/redirected etc might prove nice too.
- rhizome 12y agoRelatively few people run gateway devices with the ability to do what you're describing, but pcap is an open format and there are existing utilities for dumping (tcpdump/wireshark) and visualization (https://www.sans.org/security-resources/idfaq/visualize_data.php https://www.sans.org/security-resources/idfaq/visualize_data...).
- tlrobinson 12y agoWhat sort of firewall/router setup do you recommend?
- smilefreak 12y agoThanks for the useful list. The only problem with these things is that they require some time, effort and expertise to set up, which the average citizen may not have. I understand you are just being pragmatic, but we definitely need to work towards solutions, which works for more than the educated tech folk.
- userbinator 12y agoLuckily most things use HTTP The irony is that as people justifiably push for "more security", more and more of them are going to use HTTPS or other encrypted transports, making it impossible to determine what information they're transferring just from network inspection. End-to-end encryption is a good thing only if you trust both endpoints and don't want MITMs to interfere. Otherwise, it's security being used against you. When these smart device manufacturers "smarten up" and start encrypting everything (likely with no options to disable and/or e.g. install self-signed certificates - naturally, because of "security reasons"), it'll be all-or-nothing.
- habitue 12y agoYeah but theoretically, you should control your own devices, and be able to decrypt what they're sending because you have access to the keys they're using. (of course I realize this is complete bs, they're black boxes). Richard Stallman is looking less crazy now with all his warnings about "tivoization"
- click170 12y agoThis. When I said HTTP, I meant to include HTTPS. Intercepting HTTPS and filtering it is actually rather simple, and avoiding certificate warnings only slightly less so by deploying your own CA. You're correct that some devices may use certificate pinning to prevent me from doing this, but for those devices my solution is simple: They're denied Internet access entirely. Edit: As a manufacturer/vendor you have zero expectation of privacy from me the consumer. I bought the device, I bought the equipment that runs the network, I pay to keep the device connected to the Internet, I get the final say on which packets your app receives. Any vendor who believes otherwise is mistaken and should be named and shamed.