In the hotel's defence, I'm sure he could also go toconventional hotels and chop a hole in the wall and start messing with the wiring to achieve approximately similar "security breaches". The broken implementation is more concerning to me than the security aspects.
I stayed in a hotel with Android lightswitches and it was as bad as you'd think
301–310 of 325 posts
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#302So sad. I find the mechanics here really challenging to overcome. The hotel management no doubt wants "really cool tech" for their hotel to show they are up to date etc. And they send out an RFQ which someone bids on, really cheaply. Knowing that by only doing the things the hotel asks for, they can throw something together quickly and cheaply for a big payday. This is exactly the mechanism that gets people in troubl…
This is a nice hacking story. But when you have physical access and expertise you can hack anything. So I don't understand what's so sad about it. I do advocate security in depth, and they should probably have added a few more "layers" of security, like hide the cables and encrypt the network traffic. But then he could just use a screwdriver or pull the encryption key from the device, etc. But they probably judged that stopping kids from playing with it would be enough. The guy is a freaking firmware developer and security expert!
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#303So sad. I find the mechanics here really challenging to overcome. The hotel management no doubt wants "really cool tech" for their hotel to show they are up to date etc. And they send out an RFQ which someone bids on, really cheaply. Knowing that by only doing the things the hotel asks for, they can throw something together quickly and cheaply for a big payday. This is exactly the mechanism that gets people in troubl…
Re "nobody would do that": here's a quote from Destiny's Shield, one of the books in the Belisarius series:
"I was just thinking of the provisions of a typical Alexandrian rental agreement. For a house or an apartment. You know, the one about—"
Zeno smiled, nodding. "Yes, I know." His voice took on a sing-song cadence: " 'At the end of the term, the tenant shall return the house to the lessor free of dung.' "
He laughed himself, now. "It was so embarrassing for me, the first time I rented an apartment in Constantinople. I was puzzled by the absence of that provision in the contract. When I inquired, the landlord looked at me as if I were crazy. Or a barbarian."
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#304Earlier quoted context omitted.
None of these things sound like killer applications, and few of them require any kind of computational power let alone networking. There are much simpler ways of accomplishing the same things. That is my point; IoT proponents are adding unnecessary complexity for dubious gains. Some examples: You want to have your lights come on at a certain time. I can get a timer at a hardware store. You want to add motion detectio…
I've long been interested in "home automation" stuff, so I'll give you a quick example of what I have at my house now that can't be done with timers/motion sensors from the hardware store. There's keypad in the entrance to the kitchen, with buttons labelled "Bright" "Dim" and "All off". If you press Bright, all of the lights (sink, under-cabinet, range hood, and island) turn on 100%. Dim sets just the under-cabinet l…
> I believe a key to home automation is the automation part. If I have to control it manually, it's by definition not automated.
Yup, this.
I built an automated heating system. It does all the right things at the right times. I never touch it; it has some graphs if I want to see what it's doing.
The shoddy consumer systems all have manual control and an app, because you just spent all that money, you want the warm fuzzy feeling of having an app to fiddle with.
Marketing is why everything has to be networked.
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#305Earlier quoted context omitted.
> I learned that before that clause had been part of the standard contract, there had been a manufacturer who decided unilaterally that half of the noise suppression capacitors in the schematic were "unneeded." I don't understand how putting that in the contract is supposed to help if the manufacturer being used is pulling stupid "you didn't say the product actually had to work" semantics games that would get them sm…
Welcome to the world of law. Often I've seen it said that thinking like a software developer, looking for edge cases and such, will get you smacked down by a judge who doesn't let you just use loopholes. There is an XKCD about insurance law on this topic. But the reality is that a lot of loopholes do work, and have a better chance of working if you have a really good lawyer. Part of the equation is how charismatic a…
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#306Sorry, fanboys, but anything Android is always "as bad as you'd think"
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#307So sad. I find the mechanics here really challenging to overcome. The hotel management no doubt wants "really cool tech" for their hotel to show they are up to date etc. And they send out an RFQ which someone bids on, really cheaply. Knowing that by only doing the things the hotel asks for, they can throw something together quickly and cheaply for a big payday. This is exactly the mechanism that gets people in troubl…
This is a nice hacking story. But when you have physical access and expertise you can hack anything . So I don't understand what's so sad about it. I do advocate security in depth, and they should probably have added a few more "layers" of security, like hide the cables and encrypt the network traffic. But then he could just use a screwdriver or pull the encryption key from the device, etc. But they probably judged t…
He doesn't have physical access to the other rooms on the floor, yet he can (probably) control their lights.
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#308I surprised no one's mentioned Brillo[0] or Weave[1] from Google. They're trying to solve this problem in an open, standardized way.
[0] Brillo - Embedded Android - https://developers.google.com/brillo/
[1] Weave - Communications - https://developers.google.com/weave/
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#309Earlier quoted context omitted.
I'm totally speculating, but it could be that such clauses make the breach of contract case easier and cheaper to win. It could also be that such clear terms are useful in other jurisdictions where shenanigans like that wouldn't be smacked down without them.
This is exactly right. When you disagree with a supplier you can only disagree based on the contract, and if someone could reasonably (and there is a wide latitude here for "reasonably") argue their interpretation was within the constraints of the contract than your remediation options are limited. If you read contracts a lot (and over the years I've probably read a couple of thousand and negotiated maybe 100 or so)…
> what was clearly a problem before that had not been decided as being in breach
These are the signs that I always have a good chuckle with, thinking, "that sign is there because someone did that."
Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think
#310Earlier quoted context omitted.
Light switches that can fucking crash! Now I'm living in the future. I keep waiting for this iot/we put a chip in it/etc to produce results that are an improvement ...
https://twitter.com/internetofshit Edit: Here are the greatest hits. http://favstar.fm/users/internetofshit By the way, it seems like extreme product fail on Twitter's part that I have to go to a sketchy third party site to get the top tweets for an account.
> By the way, it seems like extreme product fail
Not necessarily. They just decided not to have this specific feature. It is a product design decision.