Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I stayed in a hotel with Android lightswitches and it was as bad as you'd think

mjg59.dreamwidth.org

Post reply on HN
Print view View original

11–20 of 325 posts

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#11

Post by elorant »

binarymax wrote: post #3

I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.

Or you could just implement them as-is, earn a shitload of money and then enhance their security in the next version or with a firmware update once you'll have the luxury of investing in R&D. At least it's better if a security-wary entrepreneur implements them instead of someone who simply doesn't give a flying fuck.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#13

Post by dcexqm »

binarymax wrote: post #3

I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.

Under pressure in an interview, yesterday, I found myself saying "'The Internet of Things' is short for 'The Internet of Things you don't need, sending surveillance data you don't want, to people you don't know.'"

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#14

Post by goldenkey »

binarymax wrote: post #3

I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.

I worked for a startup and found cross site scripting vulnerabilities and other issues like GET urls for deleting things. I was told to leave it alone and not "waste my time" because we dont have a lot of users and we weren't popular. I cringe at the justification. Security should be a necessary skill. It shouldnt be something after the fact

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#15

Post by GotAnyMegadeth »

radarsat1 wrote: post #6

Maybe it's worse: If these are really off the shelf tablets, presumably the camera can be turned on remotely. Though I'm sure the hotel would have put a piece of black tape over it, right?

And the microphone

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#16

Post by alexose »

westi wrote: post #4

This is the unfortunate outcome of a bunch of factors. OEMs moving to XXX over TCP protocols which have zero security by default and documenting this in the datasheets. VAR installers switching to the newer products because CAT5 cable is cheaper and easier to pull than what they used to use. The previous solution was just as insecure but harder to hack because you needed more specialised equipment. I'm not sure how w…

I couldn't agree more. It shouldn't surprise anyone that cheap outfits are cutting corners on something optional.

Structural engineering solved these kinds of problems with building codes. While I'm not sure that's the answer here, I think most people would welcome guidance beyond "just put whatever devices you want on a shared network and hope for the best".

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#18

Post by GFischer »

goldenkey wrote: post #14
binarymax wrote: post #3

I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.

I worked for a startup and found cross site scripting vulnerabilities and other issues like GET urls for deleting things. I was told to leave it alone and not "waste my time" because we dont have a lot of users and we weren't popular. I cringe at the justification. Security should be a necessary skill. It shouldnt be something after the fact

I think they were right to tell you to leave them alone, but a better answer would be: "we'll add them to our backlog (or whatever way you manage issues or work), and get to them by X iteration". As long as you were really working on an MVP and not a version 1.x .

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#19

Post by vonmoltke »

binarymax wrote: post #3

I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.

In addition to this, my problem is usually, "I could solve that problem with $5 in discrete electronic components." :P

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#20

Post by larrik »

Kliment wrote: post #8
eloff wrote: post #5

Turning lights on at 3 a.m. is a nuisance. Knowing when lights go on and off can tell you when the people are not in their room - which could help if you wanted to break in and steal their stuff. Overall quite disconcerting how lax they are with security.

I think the implication was that some asshole can obtain photos of you sleeping by opening the curtains and switching on the lights in the middle of the night. A nuisance, sure, but also a massive violation of privacy.

I didn't get that implication at all, that's some creepy stuff there.
Post reply on HN