More awful IoT stuff • Hacker News Board

Re: More awful IoT stuff

#11

Post by Klathmon » Wed, Jun 22, 2016, 1:10 PM UTC

Feneric wrote: post #6

IoT devices can be fine, but there are lots of companies involved in it that don't know what they're doing and would be better off staying out of the market. I always advice friends / family to look for upgrading capabilities, ability to do useful work when not connected to the Internet proper, user control (do you own this device or effectively borrow it per licensing etc.?), and other similar things before purchasi…

And it sounds like this one was like 80% of the way there. I mean they used encryption (badly, but they still used it), had a way to update the software on the device (even if only over http), and uses passwords (although doesn't enforce them).

Re: More awful IoT stuff

#12

Post by apozem » Wed, Jun 22, 2016, 1:11 PM UTC

> Eventually I plugged my phone into my laptop and ran adb logcat, and the Android debug logs told me that the app was trying to modify a network that it hadn't created. Apparently this isn't permitted as of Android 6, but the app was handling this denial by just trying again. I deleted the network from the system settings, restarted the app, and this time the app created the network record and could modify it. It still didn't work, but that's because it let me give it a 5GHz network and it only has a 2.4GHz radio, so one reset later and I finally had it online.

Madness. And people wonder why there's so much skepticism about IoT being adopted by non-techies.

Re: More awful IoT stuff

#13

Post by mcphage » Wed, Jun 22, 2016, 1:11 PM UTC

bedhead wrote: post #2

@internetofshit is a great follow and pretty quickly illustrates just how absurd the IoT rush has become. Solutions in search of problems.

> Solutions in search of problems.

Solutions in search of money before the market wises up to how crap these products are.

Re: More awful IoT stuff

#14

Post by leni536 » Wed, Jun 22, 2016, 1:15 PM UTC

marktangotango wrote: post #9

jussaskin wrote: post #7

IoT is all about unsecured devices generally?

That's been my understanding as well. The cpu's used typically aren't powerful enough to do anything other than simple encryption in a reasonable amount of time. Ssl is generally out of the question. Someone please educate me if that's incorrect.

I'm not a cryptographer, in my hobby project I used a port of nacl to AVR to do encryption. Such an IoT device doesn't need to process a large amount of data for encryption, it can be done on a 8bit uC.

Re: More awful IoT stuff

#15

Post by mavhc » Wed, Jun 22, 2016, 1:15 PM UTC

marktangotango wrote: post #9

jussaskin wrote: post #7

IoT is all about unsecured devices generally?

That's been my understanding as well. The cpu's used typically aren't powerful enough to do anything other than simple encryption in a reasonable amount of time. Ssl is generally out of the question. Someone please educate me if that's incorrect.

Sounds more like the companies aren't bothered enough to pay for someone who knows what they're doing in a reasonable amount of time.

Re: More awful IoT stuff

#16

Post by icebraining » Wed, Jun 22, 2016, 1:16 PM UTC

BostonEnginerd wrote: post #10

mikegerwitz wrote: post #8

Earlier quoted context omitted.

> Has the GPL really lost it's power that much? It's up to the copyright holder to enforce it.

I don't believe that's the case. As an owner of a device with GPL code on it, you are entitled to the source as well.

You are entitled by the license, but only the copyright holder can sue for the violation.

Re: More awful IoT stuff

#17

Post by icebraining » Wed, Jun 22, 2016, 1:21 PM UTC

marktangotango wrote: post #9

jussaskin wrote: post #7

IoT is all about unsecured devices generally?

That's been my understanding as well. The cpu's used typically aren't powerful enough to do anything other than simple encryption in a reasonable amount of time. Ssl is generally out of the question. Someone please educate me if that's incorrect.

I don't think so, but even if they were, you can buy a crypto co-processor for less than $1/unit.

Re: More awful IoT stuff

#18

Post by diggan » Wed, Jun 22, 2016, 1:24 PM UTC

So there is a great amount of lists, blogposts and information about awful/bad IoT things, but if someone like me want to have a list about IoT things that are actually secure and well-working, where would I find that?

Re: More awful IoT stuff

#19

Post by jenscow » Wed, Jun 22, 2016, 1:26 PM UTC

marktangotango wrote: post #9

jussaskin wrote: post #7

IoT is all about unsecured devices generally?

That's been my understanding as well. The cpu's used typically aren't powerful enough to do anything other than simple encryption in a reasonable amount of time. Ssl is generally out of the question. Someone please educate me if that's incorrect.

By the way, the chips of smartcards are enough to perform encryption, as well as storing keys.

(fast enough for streams in 'real-time' - I don't know)

Re: More awful IoT stuff

#20

Post by jerf » Wed, Jun 22, 2016, 1:27 PM UTC

marktangotango wrote: post #9

jussaskin wrote: post #7

IoT is all about unsecured devices generally?

That's been my understanding as well. The cpu's used typically aren't powerful enough to do anything other than simple encryption in a reasonable amount of time. Ssl is generally out of the question. Someone please educate me if that's incorrect.

As usual, "it depends".

If this thing is capable of running OpenWRT, it can run some sort of SSL for what it needs. Might be tight and might have to not be OpenSSL, but it can be done.

Lesser-capable devices may have issues. But note that one way or another, the devices must speak some decent encryption to get on to WPA2 networks. Of course that's probably done in the Wifi hardware, but it still shows that it's not like we're living in the 1980s where we literally wouldn't have been able to afford the silicon in a consumer device. Hardware acceleration of SSL shouldn't be that hard to get a hold of, for instance: https://en.wikipedia.org/wiki/SSL_acceleration#Central_proce...