Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I stayed in a hotel with Android lightswitches and it was as bad as you'd think

mjg59.dreamwidth.org

Post reply on HN
Print view View original

121–130 of 325 posts

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#121

Post by goodcanadian »

zanny wrote: post #106
goodcanadian wrote: post #74

This is why I don't understand the "Internet of Things." A light switch is a pretty effective solution to the problem; there seems little advantage to networking it. Ditto for a toaster, refrigerator, et cetera, et cetera. Now get off my lawn!

You want to have your lights come on at a certain time. You want to add motion detection to lights turning on. You want to attach light sensors to have variable intensity bulbs be brighter or dimmer depending on ambient lighting conditions. You want your lights to turn on inside your garage when the garage door opens. You want your front hallway light to come on when your door is opened. You want to be able to check…

None of these things sound like killer applications, and few of them require any kind of computational power let alone networking. There are much simpler ways of accomplishing the same things. That is my point; IoT proponents are adding unnecessary complexity for dubious gains. Some examples:

You want to have your lights come on at a certain time.

I can get a timer at a hardware store.

You want to add motion detection to lights turning on.

I can get a motion sensor switch at a hardware store.

You want your lights to turn on inside your garage when the garage door opens.

Yep. That happens with most existing garage door openers.

You want your front hallway light to come on when your door is opened.

I've never seen this implemented, but it could be done in a multitude of ways such as the motion sensor or a simple contact switch on the door itself.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#122

Post by watty »

matthewmacleod wrote: post #111
watty wrote: post #104

Earlier quoted context omitted.

I mean he did unplug network equipment and MiTM, if this isn't illegal it probably should be. I see ethernet cables all the time in things like hospitals and hotels, should anyone be able to simply unplug them and put their laptops in the middle?

Yes, anybody should be able to do that with no legal consequences. If you don't want to give people access to your network, don't provide them with a fucking port and cable explicitly designed for doing so.

Come on now, you really think people should be able to unplug cables anywhere they go? This could have major consequences at a hospital.

Edit: Completely agree Ska, no excuse for making it this easy. I'm just pointing out that just because it's easy to pick a lock or unplug some wires to MiTM doesn't mean it should be legal.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#123

Post by dsr_ »

draw_down wrote: post #80
binarymax wrote: post #3

I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.

Yes, I'm sure that the only thing standing between you and untold riches is your resistance to lax security measures in app-controlled sous vide machines.

The security risk in an app-controlled sous vide machine includes starting a fire that burns your house down.

- Sous vide normally uses a water bath at a controlled low temperature over a long period of time.

- Hike the temperature up past the boiling point, and the water is evaporated, allowing you to hike the temperature up to ignition points.

- Or, cycle the electronics fast enough to overload the power supply. If it isn't designed well, either the wall circuit blows or the power supply bursts into flame.

- In any case, the expectation of a long unattended cooking process means that human observers might not be in the loop.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#124

Post by eric_h »

Biganon wrote: post #112
Kliment wrote: post #8

Earlier quoted context omitted.

I think the implication was that some asshole can obtain photos of you sleeping by opening the curtains and switching on the lights in the middle of the night. A nuisance, sure, but also a massive violation of privacy.

You'd need to access the balcony first, assuming there's one. Why would you think of that first?

> You'd need to access the balcony

Or a camera equipped drone.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#125

Post by hamburglar »

Biganon wrote: post #112
Kliment wrote: post #8

Earlier quoted context omitted.

I think the implication was that some asshole can obtain photos of you sleeping by opening the curtains and switching on the lights in the middle of the night. A nuisance, sure, but also a massive violation of privacy.

You'd need to access the balcony first, assuming there's one. Why would you think of that first?

Don't worry, this hotel also has a modbus-controlled window washer's crane on the same network.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#126

Post by kefka »

matthewmacleod wrote: post #107

This is absolutely fucking preposterous. The 'Internet of Things' or whatever you want to call it – controllable peripherals, ubiquitous connections, stuff like that – is a pretty cool concept. I want to be easily able to do things like ask 'when will my laundry be finished?', or have my central heating come on when I start heading home. Not because it's massively beneficial, but because it removes some minor annoyan…

That's what I've been doing.

For the local hardware, I use Arduino Nano clones, nRF24L01+ mesh networking chip, whatever sensors/actuators, and the MySensors library. Encryption and packet signing are both turned on.

On the gateway, it is just a serial console opened up to a Arduino Nano and nRF24L01+. I use Node-Red on the machine the serial gateway is plugged into. I also use the MQTT broker Mosquitto as my backing store for IoT data, from any of my machines. I design my architecture around that.

To connect between physical areas (from house to hackerspace), I use Tor Hidden Services, giving each endpoint a .onion address. With that, all my computers on the .Onion network can talk with each other as if they are on medium-high latency hub. And it also solves the problem of "staticIP/port forwarding/firewall rule change/dynDNS" crap. I drop Tor, set up a hidden service, route 22 to Tor, and off it goes. All I need do is keep track of that onion address.

And that provides me devices I have complete control over, utilizing a cloud of computers I own. I'm looking in how I can blend in IPFS as well for logging capabilities.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#127

Post by wpietri »

nickysielicki wrote: post #53

I feel like the only thing that can fix this type of mentality is a line of products targeted towards annoying nerdy 13 year old boys-- the type of boy that a lot of us were. We need to make it easy for them to abuse security lapses in IoT products. When I was in middle school, I brought a universal remote to class and turned on the television set. Yeah, I know, I was a badass. But these kids will do much more. The p…

Not sure why this is getting downvoted. This is a big part of what happened with internet security over the years.

Back at the dawn of time, less than a billion seconds from epoch, it was considered rude to exploit obvious security holes. People would actually track down casual hackers and get them in trouble. But once script kiddies came on the scene, it became a lost cause. Once it could be any 14-year-old idiot on the planet scanning your ports and exploiting your old, unpatched software, it became clear that tacit agreements and social pressure weren't enough. The burden of security began to shift to people who created the software.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#128

Post by bryanlarsen »

justaaron wrote: post #119

why on earth are the 2 largest and highest valued technological companies in human history repurposing mainframe multi-user computer operating systems from the 1970's (extended even further with sandboxed app containers!) for mobile phones!? It smacks of deliberate incompetence to sell hardware. iOT on top of this just smacks, again, of deliberate incompetence, to either sell hardware or raise the attack vector profi…

There's nothing in the article about Android, it's only in the title.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#129

Post by lmm »

collyw wrote: post #46
joepie91_ wrote: post #23

Earlier quoted context omitted.

No. Bolt-on security doesn't work. It is either possible to do something securely and won't really take significantly more time, or it's not possible to do it securely at all, and no future update is going to fix it.

So why do I bother clicking "install updates" on machine every few days?

Because in practice, for the moment, there is a difference between "insecure" and "insecure and being exploited in the wild".

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#130

Post by robotmlg »

Klathmon wrote: post #97
corobo wrote: post #68

Earlier quoted context omitted.

Great my fridge just rebooted for a firmware update and bricked itself now the peas are rapidly defrosting and I am in a panic. Edit: Shoutout to Internet of Shit https://twitter.com/internetofshit

There are way to build things so that this isn't a problem. Modularize. It's easy to build it in a way so that the worst that the software can do is cause it to turn into a "dumb" fridge. My problem with this whole hatred of iot is that it's not productive. it's a bunch of people commenting how the trend is dumb and how everything was so much better in the past. Nobody ever gives suggestions on how to improve it, or…

> It's easy to build it in a way so that the worst that the software can do is cause it to turn into a "dumb" fridge.

If it's so easy, why don't more companies do it? Why didn't Nest build their thermostats so that when the battery runs out, it reverts to a "dumb" thermostat instead of turning off your heat? http://www.theguardian.com/technology/2016/jan/15/bug-nest-t...

Post reply on HN