Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I stayed in a hotel with Android lightswitches and it was as bad as you'd think

mjg59.dreamwidth.org

Post reply on HN
Print view View original

111–120 of 325 posts

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#111

Post by matthewmacleod »

watty wrote: post #104
liveoneggs wrote: post #2

prepare to be arrested for various violations as a punishment for pointing out these obvious and dangerous flaws.

I mean he did unplug network equipment and MiTM, if this isn't illegal it probably should be. I see ethernet cables all the time in things like hospitals and hotels, should anyone be able to simply unplug them and put their laptops in the middle?

Yes, anybody should be able to do that with no legal consequences. If you don't want to give people access to your network, don't provide them with a fucking port and cable explicitly designed for doing so.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#112

Post by Biganon »

Kliment wrote: post #8
eloff wrote: post #5

Turning lights on at 3 a.m. is a nuisance. Knowing when lights go on and off can tell you when the people are not in their room - which could help if you wanted to break in and steal their stuff. Overall quite disconcerting how lax they are with security.

I think the implication was that some asshole can obtain photos of you sleeping by opening the curtains and switching on the lights in the middle of the night. A nuisance, sure, but also a massive violation of privacy.

You'd need to access the balcony first, assuming there's one. Why would you think of that first?

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#113

Post by rietta »

goldenkey wrote: post #14
binarymax wrote: post #3

I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.

I worked for a startup and found cross site scripting vulnerabilities and other issues like GET urls for deleting things. I was told to leave it alone and not "waste my time" because we dont have a lot of users and we weren't popular. I cringe at the justification. Security should be a necessary skill. It shouldnt be something after the fact

This is why I absolutely believe and publicly talk about security being a matter of developer ethics. I have used my walk away power to get a company to do the security they needed in a similar, but not quite the same type of situation.

Here is the professional ethics piece of a talk I gave last year to a developer meetup: https://www.youtube.com/watch?v=dj196NhPyWs&t=43m36s

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#114

Post by ccvannorman »

amelius wrote: post #63
dcexqm wrote: post #13

Earlier quoted context omitted.

Under pressure in an interview, yesterday, I found myself saying "'The Internet of Things' is short for 'The Internet of Things you don't need, sending surveillance data you don't want, to people you don't know.'"

> to people you don't know What is worse, your data being sent to people you know or to people you don't know ?

Depends -- WILL I know them afterwards?

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#115

Post by brianwawok »

dcexqm wrote: post #13
binarymax wrote: post #3

I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.

Under pressure in an interview, yesterday, I found myself saying "'The Internet of Things' is short for 'The Internet of Things you don't need, sending surveillance data you don't want, to people you don't know.'"

I would have hired you

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#116

Post by rietta »

michaelbuckbee wrote: post #29
goldenkey wrote: post #14

Earlier quoted context omitted.

I worked for a startup and found cross site scripting vulnerabilities and other issues like GET urls for deleting things. I was told to leave it alone and not "waste my time" because we dont have a lot of users and we weren't popular. I cringe at the justification. Security should be a necessary skill. It shouldnt be something after the fact

I call this the "we don't do anything special" fallacy. They consider hackers to be something like in the movies where a team of slick black leather clad folks plan a digital heist, and why should a bunch of movie stars care about our little business. In truth it's much much more like how Google just has computers trying to index every site on the internet that they can find. Most of the attacks these days are broad…

Absolutely true! I have to tell people that many attacks just try every door to see if its unlocked. They are not movie plot-style targeted attacks. And such an attack can and do lead to data breaches!

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#117

Post by pgeorgi »

masklinn wrote: post #102
theseatoms wrote: post #82

Earlier quoted context omitted.

Add a physical switch for firmware updates, on an opt-in basis. How does Tesla implement updates?

> How does Tesla implement updates? Tesla has a pretty vested interest in shit keeping working considering it's a pretty luxurious and high-profile product. The cut-price manufacturer of your $20 lightbulb or $300 fridge? Not so much.

The cheapest Chromebooks ship at $149 and have a pretty much unbrickable automated update flow that includes the firmware for the CPU and embedded controller(s).

It's not a matter of luxury, it's a matter of having people work on it who care.

Disclosure: I work with them. Much <3 :)

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#118

Post by wpietri »

Kristine1975 wrote: post #59
GFischer wrote: post #44

Earlier quoted context omitted.

Ok, I'll clarify: I think they were right as long as it was a throwaway prototype. And the GET delete operations are probably a bad idea even for a prototype. I was thinking of a rewrite for release 1.x. I don't have enough knowledge of the stage the OP's startup was to have answered, so I stand corrected.

I'm scared that when the prototype is done someone says "looks good, ship it!"

That's a totally legitimate fear.

These days, this is the kind of thing I negotiate up front. When they ask me how long something will take, I explain that they can have a prototype quickly, but only if they promise to throw it away as soon as the experiment is done. I explain that they can have me build a movie set or a real house, but that there's nothing in between. [1] And then I leave the choice up to them, explaining that it's really about their business judgement.

Generally people keep their promises on this, although sometimes it takes a little reminding. When they do, the business benefits are substantial. A good product person really benefits from doing quick, cheap experiments. And they also benefit from having a solid platform of high-reliability code for production use. But they can only get the benefits of both if they're careful not to mix the two.

[1] There is actually something between, but they don't want it: http://agilefocus.com/2009/06/22/the-3-kinds-of-code/

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#119

Post by justaaron »

why on earth are the 2 largest and highest valued technological companies in human history repurposing mainframe multi-user computer operating systems from the 1970's (extended even further with sandboxed app containers!) for mobile phones!?

It smacks of deliberate incompetence to sell hardware.

iOT on top of this just smacks, again, of deliberate incompetence, to either sell hardware or raise the attack vector profile (the NSA loves you!)

why on earth is there still no reasonable competition to either android or ios?

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#120

Post by mikestew »

Kristine1975 wrote: post #59
GFischer wrote: post #44

Earlier quoted context omitted.

Ok, I'll clarify: I think they were right as long as it was a throwaway prototype. And the GET delete operations are probably a bad idea even for a prototype. I was thinking of a rewrite for release 1.x. I don't have enough knowledge of the stage the OP's startup was to have answered, so I stand corrected.

I'm scared that when the prototype is done someone says "looks good, ship it!"

I'm old and have been in this industry a long time, and I'm genuinely surprised on those oh-so-rare occasions when what you describe doesn't happen.

Prototypes-become-products is a trope much like _The Mythical Man Month_. We all nod knowingly when it is mentioned, we all know how it will turn out, and then we (well, management dictates that we...) turn right around and do the opposite.

Post reply on HN