The title is implying that Android is the culprit here, and not just a horrible design and implementation.
I stayed in a hotel with Android lightswitches and it was as bad as you'd think
61–70 of 325 posts
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#62Earlier quoted context omitted.
Wouldn't the way to go about this be: Create an MVP (w/out much security) - get funding for the MVP, hire security experts, get over the obstacles?
I wonder if the competition wouldn't just skip the security, then beat you on the price because you are paying lots of money for security experts. Most customers don't care about/understand security and your company fails.
Find a way to demonstrate the flaws in various products, aim for non-consumer markets. Businesses that have an actual motivation to have secure devices like the hotel in the article would be more inclined to spend the extra money, especially if it at least eliminated a trivially hackable configuration like, again, in the article.
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#63I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.
Under pressure in an interview, yesterday, I found myself saying "'The Internet of Things' is short for 'The Internet of Things you don't need, sending surveillance data you don't want, to people you don't know.'"
> to people you don't know
What is worse, your data being sent to people you know or to people you don't know?
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#64And here I thought the video game Gunpoint (where you rewire switches, lights and doors among other things) was unrealistic.
Although I'm a bit disappointed mjg59 didn't play Blinkenlights with the rooms on his floor.
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#65I feel like the only thing that can fix this type of mentality is a line of products targeted towards annoying nerdy 13 year old boys-- the type of boy that a lot of us were. We need to make it easy for them to abuse security lapses in IoT products. When I was in middle school, I brought a universal remote to class and turned on the television set. Yeah, I know, I was a badass. But these kids will do much more. The p…
Except that nowadays they'll be locked up for 5 years.
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#66I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.
Under pressure in an interview, yesterday, I found myself saying "'The Internet of Things' is short for 'The Internet of Things you don't need, sending surveillance data you don't want, to people you don't know.'"
If you find yourself saying something uncomfortable under pressure, this is probably not the right place for you.
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#67Earlier quoted context omitted.
I build stuff like that - my approach is to limit capabilities to the absolute minimum, and anything that is not needed for function but necessary for debug/diagnostics stays on the device rather than going across the network. This limits the devices a fair bit - firmware update across the network with no local interaction is not allowed, nor is accessing the local data store. Want to email me and talk about this?
Which is exactly what a physical switch would do. No wireless internet, no GUI, just a switch.
Absolutely - and for a light switch it's appropriate. As an example of a thing that needs internet to function, consider a heater controller that has a high power and low power mode depending on momentary cost of electricity - it fetches price data across the network, and it's important to log things like temperature at various points of the device for diagnostics. Now, it's very tempting to send the diagnostic data across the network, but this leaks usage information. It's also tempting to allow things like remote configuration, firmware updates and reading device memory for debug, but that can leak network access credentials or make the device a beachhead for access to the internal network. This is why any feature like that is to be avoided and, if present, needs to be activated from the device itself, not remotely. If you NEED remote control, see if you can limit its scope of functionality to the bare minimum, and consider who needs access to it - in the case of the heater controller, the provider of the pricing data doesn't need to know or control the state of the device, so there's no need to allow that on that connection. Where possible, make the device a CLIENT rather than a SERVER - have the device itself initiate connections, to an address that is entered by local interaction, rather than accept connections from anywhere. If you MUST break those rules and accept connections from anywhere, that's when you really need to spend a fuckton of effort securing every aspect of your device, client applications, and protocol.
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#68Earlier quoted context omitted.
Did you keep a straight face while you suggested that people actually upgrade firmware?
Keep in-mind that we're talking about always connected devices. Firmware updates could be done remotely without the end user needed to do anything, except perhaps give his approval.
Great my fridge just rebooted for a firmware update and bricked itself now the peas are rapidly defrosting and I am in a panic.
Edit: Shoutout to Internet of Shit https://twitter.com/internetofshit
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#69I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.
Under pressure in an interview, yesterday, I found myself saying "'The Internet of Things' is short for 'The Internet of Things you don't need, sending surveillance data you don't want, to people you don't know.'"
Well, coming up with that while being under pressure is still to be commended for.
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#70Having stayed at a similar (same) hotel don't even get me started on the guest experience. It took longer to familiarise myself with all the controls in the room than a normal stay in the hotel. Also really appreciated the slight glow all the tablets gave off at night...well they did until they got covered with cushions and gaffer tape!
Jarrod