71–80 of 152 posts
Honestly most of the IOT consumer tech infrastructure does security via the "please don't look at me" approach. Still don't know exactly why my home assistant can discover & control my wifi bulbs...never provided passwords or anything.
Honestly most of the IOT consumer tech infrastructure does security via the "please don't look at me" approach. Still don't know exactly why my home assistant can discover & control my wifi bulbs...never provided passwords or anything.
Oh, you must use an Amazon product, they sync wifi passwords across all your devices.
Are there any open-source hardware/software ESP clones. Similar to what Arduino did in the micro-controller space?
Earlier quoted context omitted.
Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary push for open drivers/firmware (Broadcom itself, just to name one, has had strong ties with the US govt for a long time). I can imagine a meeting in which some high rank officer says "Here's our backdoor blob, you merge this to all your chipsets firmware, so when necessary we can…
> Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary This is false. In most western countries governments cant force HW makers to add backdoor.
Even in China, they might not need to rely on explicit state security authority, just tie it up with state sponsored funding or other softer measures.
First and foremost, this speaks to the ubiquity and hacker friendliness of Espressif's chips. Most of their competitors (I'm looking at you, Broadcom), prefer security through obscurity and make it extremely difficult to get access to chips, let alone SDKs. I am certain that similar vulnerability exist in every embedded WiFi chipset out there. That being said, the status quo is completely untenable. Connectivity has…
Espressif have not released the sources of the WiFi implementation, just binaries. I would define that as "security through obscurity".
https://github.com/espressif/esp32-wifi-lib/issues/2 https://github.com/espressif/esp-idf/commit/c1396830243b4c8f...
Earlier quoted context omitted.
> Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary This is false. In most western countries governments cant force HW makers to add backdoor.
Portions of the US government have tried multiple times to make the addition of backdoors required via public force of law. They're still trying to promote it now. Short of that public requirement, they can ask & issue orders to not discuss the matter, tie it with defense orders, or imply the withholding of export or trade licenses, all contingent upon cooperation. In the end it looks pretty blurry between a request…
They can't do that.
Earlier quoted context omitted.
Portions of the US government have tried multiple times to make the addition of backdoors required via public force of law. They're still trying to promote it now. Short of that public requirement, they can ask & issue orders to not discuss the matter, tie it with defense orders, or imply the withholding of export or trade licenses, all contingent upon cooperation. In the end it looks pretty blurry between a request…
> they can ask & issue orders to not discuss the matter, They can't do that.
Earlier quoted context omitted.
I suppose "relatively few people" is true if you define people the way it would have been understood a century ago. Corporate and institutional systems will almost invariably do WPA2 Enterprise. Without Enterprise, there's just one magic shared key "password" known to every user of the network. The Enterprise mode outsources authentication of participants to a separate service using EAP and nearly always ends up leve…
I was talking in terms of IoT devices using these chips - more of them are likely to be on home networks, using WPA2 Personal than in offices using the enterprise version. For offices, wired smart devices or higher end wireless devices are more common, which tend to use custom silicon, rather than COTS modules like the ESP ones. Hue bulbs, for example, don't use ESP derived chips (if only because they need Zigbee rat…
The "big boys" probably use custom made silicon (but even then I've seen custom-made silicon with an ESP8266 mounted onto it to abstract out the wifi connection part), but I wouldn't be surprised if the majority of IIoT startups use the ESPs as part of their products.
Are there any open-source hardware/software ESP clones. Similar to what Arduino did in the micro-controller space?
It would be really hard to "clone" a SOC. Since its not a board that you can print for a buck these days, it actually requires a fab to print chips ... which is not something that is common to open source yet.
Honestly most of the IOT consumer tech infrastructure does security via the "please don't look at me" approach. Still don't know exactly why my home assistant can discover & control my wifi bulbs...never provided passwords or anything.
Oh, you must use an Amazon product, they sync wifi passwords across all your devices.
Not this is homeassistant - open source stuff. Aim of the game is to avoid amazon/google etc.