Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I stayed in a hotel with Android lightswitches and it was as bad as you'd think

mjg59.dreamwidth.org

Post reply on HN
Print view View original

51–60 of 325 posts

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#51

Post by elorant »

nly wrote: post #37
elorant wrote: post #11

Earlier quoted context omitted.

Or you could just implement them as-is, earn a shitload of money and then enhance their security in the next version or with a firmware update once you'll have the luxury of investing in R&D. At least it's better if a security-wary entrepreneur implements them instead of someone who simply doesn't give a flying fuck.

Did you keep a straight face while you suggested that people actually upgrade firmware?

Keep in-mind that we're talking about always connected devices. Firmware updates could be done remotely without the end user needed to do anything, except perhaps give his approval.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#52

Post by laggyluke »

nly wrote: post #37
elorant wrote: post #11

Earlier quoted context omitted.

Or you could just implement them as-is, earn a shitload of money and then enhance their security in the next version or with a firmware update once you'll have the luxury of investing in R&D. At least it's better if a security-wary entrepreneur implements them instead of someone who simply doesn't give a flying fuck.

Did you keep a straight face while you suggested that people actually upgrade firmware?

If it's a true IoT, people might not really have a choice ;)

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#53

Post by nickysielicki »

I feel like the only thing that can fix this type of mentality is a line of products targeted towards annoying nerdy 13 year old boys-- the type of boy that a lot of us were. We need to make it easy for them to abuse security lapses in IoT products. When I was in middle school, I brought a universal remote to class and turned on the television set. Yeah, I know, I was a badass. But these kids will do much more.

The problem is that when a software engineer goes to the front desk of a hotel and complains about the security of the brand new Android-Powered Hi-Tech system that they just put in, the person working the desk thinks, "Haha wow! That nerd was a real Sheldon Cooper, like on the television!" and they don't care at all. If you live in a bubble where programming and computer work is black magic, well then of course it is completely inevitable that someone so nerdy and so smart would be able to hack everything on the planet. So they don't really think there's anything to be done.

When it's a group of annoying little 15 year olds that sneak out in the middle of the night to wake up all of your guests, it's a lot bigger of a deal.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#55

Post by [deleted] »

nly wrote: post #37
elorant wrote: post #11

Earlier quoted context omitted.

Or you could just implement them as-is, earn a shitload of money and then enhance their security in the next version or with a firmware update once you'll have the luxury of investing in R&D. At least it's better if a security-wary entrepreneur implements them instead of someone who simply doesn't give a flying fuck.

Did you keep a straight face while you suggested that people actually upgrade firmware?

[deleted]

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#56

Post by vonmoltke »

GFischer wrote: post #44
Jtsummers wrote: post #28

Earlier quoted context omitted.

That's technical debt, and it's hard to fix. A prototype, sure, it can have flaws, it's a proof of concept of feature X, not feature X SECURED. But then the release has to be a rewrite. If it's not, those flaws are more likely to become permanent. And when they do begin work on repairing their codebase, they'll spend several times the money and time to fix than if they'd spent some time early on. They'll also likely…

Ok, I'll clarify: I think they were right as long as it was a throwaway prototype. And the GET delete operations are probably a bad idea even for a prototype. I was thinking of a rewrite for release 1.x. I don't have enough knowledge of the stage the OP's startup was to have answered, so I stand corrected.

In my experience, "throwaway" prototypes almost never are.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#57

Post by patcheudor »

"Jesus Molina talked about doing this kind of thing a couple of years ago, so it's not some kind of one-off - instead, hotels are happily deploying systems with no meaningful security, and the outcome of sending a constant stream of "Set room lights to full" and "Open curtain" commands at 3AM seems fairly predictable."

Which takes us to this: "Any sufficiently advanced technology controlled by a miscreant is indistinguishable from a possessed object in a Stephen King Novel."

http://thefutureisastephenkingnovel.com/assets/player/Keynot...

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#58

Post by vonmoltke »

elorant wrote: post #51
nly wrote: post #37

Earlier quoted context omitted.

Did you keep a straight face while you suggested that people actually upgrade firmware?

Keep in-mind that we're talking about always connected devices. Firmware updates could be done remotely without the end user needed to do anything, except perhaps give his approval.

Which introduces a whole new set of security challenges to prevent attackers from getting write access to the devices.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#59

Post by Kristine1975 »

GFischer wrote: post #44
Jtsummers wrote: post #28

Earlier quoted context omitted.

That's technical debt, and it's hard to fix. A prototype, sure, it can have flaws, it's a proof of concept of feature X, not feature X SECURED. But then the release has to be a rewrite. If it's not, those flaws are more likely to become permanent. And when they do begin work on repairing their codebase, they'll spend several times the money and time to fix than if they'd spent some time early on. They'll also likely…

Ok, I'll clarify: I think they were right as long as it was a throwaway prototype. And the GET delete operations are probably a bad idea even for a prototype. I was thinking of a rewrite for release 1.x. I don't have enough knowledge of the stage the OP's startup was to have answered, so I stand corrected.

I'm scared that when the prototype is done someone says "looks good, ship it!"

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#60

Post by joezydeco »

thoughtsimple wrote: post #33

I'm amused by the use of Modbus. I worked on Modbus networking back in the 1980's at Modicon (a company that disappeared long ago that created the "standard"). Using a protocol invented before the internet to control devices on a semi-public network is insane. The original Modbus was designed to communicate with factory devices controlled by logic controllers over serial and eventually over a custom token ring networ…

Perhaps the hotel's HVAC is running Modbus?
Post reply on HN