Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White House unveils Cyber Trust Mark program for consumer devices

nextgov.com

Post reply on HN
Print view View original

121–130 of 164 posts

Re: White House unveils Cyber Trust Mark program for consumer devices

#121

Post by kube-system »

ocdtrekkie wrote: post #103
kube-system wrote: post #94

Earlier quoted context omitted.

Do they require auth and use solid crypto? If not, they are vulnerable, it's just that the vulnerability requires the attacker to be within range. People thought old analog 900mhz cordless phones were fine until others realized you could just tune a radio to that freq and listen to your neighbors.

They're not vulnerable in any way that matters. If you manage to get a device in range you can... turn my lights on and off? You can't program them to do malicious things over the Internet. They don't have any sensitive information you can access. There's no damage you can do them. The problem with saying you need auth and crypto is now you just added a bunch of complexity you have to maintain and update and hence no…

Sure, keeping things offline and vulnerable to only local attackers is a valid security posture for some.

But the 'I' in IoT is for internet. "Don't build IoT devices" is not a helpful proposal to increase the security of IoT devices, which is the scope of this initiative.

Re: White House unveils Cyber Trust Mark program for consumer devices

#122

Post by kube-system »

ndriscoll wrote: post #100
kube-system wrote: post #98

Earlier quoted context omitted.

No, it is a good idea. If someone is operating or changing settings on your baby monitor, doorbell camera, garage door opener, smart switch, light bulb, etc -- the developer should check to make sure that the actor doing so is authorized to do it. Why in the world would anyone want unauthenticated access to these devices?

All of those things might have a authentication-free use-case for e.g. a babysitter (maybe not to change settings, but to use). For personal networks, being on your local LAN is in practice a decent form of authentication given the tradeoffs of otherwise having to manage credentials.

That seems a bit contrived. I would expect my babysitter to be observing a child in-person, not remotely.

Regardless, the commonly expected use case for IoT devices is for people to be able to access them from their mobile device, on the internet (thus the 'I' in IoT). IoT devices, as their name implies, are on the internet, and need authentication because of this.

The problem is that this use case is real, and people are buying these devices, and so, how do we make them better? "Just don't do that" doesn't address the problem, it's a dismissal of it.

Re: White House unveils Cyber Trust Mark program for consumer devices

#123

Post by ndriscoll »

kube-system wrote: post #120
ndriscoll wrote: post #110

Earlier quoted context omitted.

So don't put them on the open Internet. It's much easier to do that than it is to secure a device that creates outbound connections to some untrusted external server (which manufacturers are). If it doesn't try to use UPnP or anything, it will not be in the open by default. If your threat model for consumer IoT devices does not include manufacturers in 2025, you are completely confused about computer security. Having…

> So don't put them on the open Internet. That's a valid answer for an audience familiar with computer networking concepts. It's a silly suggestion for consumer IoT customers, who do not understand those concepts. They don't know what is or is not 'on the open internet'; they buy a product at the store and plug it in. > We should have certifications that devices create no outbound TCP/UDP flows. This is the "bury you…

IoT customers by default would not have devices exposed to the Internet. This has been the status quo for decades ever since wifi and NAT became popular. If they don't understand it, it will be secure by default.

It would be technically quite easy for either a dedicated home-access box or just the router-AP combo box to have some auto-config wireguard setup (e.g. scan a QR code or install an app that looks for the box on the local network or through bluetooth). This would be far more secure than the current setup, which is for devices to constantly connect to generally malicious C&C servers. If regulations pushed for actual security (no-cloud), this would be the obvious solution to guide to market toward. Then you only have to trust your gateway device, which also would have no reason to ever create outgoing Internet connections, though it would need outgoing/forwarded LAN connections.

With SLAAC to generate a random initial IPv6 address that it never rotates combined with UDP so there's no indication that you talked to anything if your wireguard keys are wrong, there's basically no way to find such a box if you didn't have the correct config.

Re: White House unveils Cyber Trust Mark program for consumer devices

#124

Post by ssl-3 »

simne wrote: post #111
ssl-3 wrote: post #107

Earlier quoted context omitted.

None of the electronic widgets I've bought stateside from overseas sources have ever shown any evidence that they've ever been actually-inspected by US Customs. How would they know that an item is fraudulently marked if they never look?

For all things you buy in local shop, responsible owners of shop. If you buy anything abroad, this is your own problem and it is not relevant to subject.

I note that none of these entities are the "customs" that I have heard about.

Re: White House unveils Cyber Trust Mark program for consumer devices

#125

Post by kube-system »

ndriscoll wrote: post #123
kube-system wrote: post #120

Earlier quoted context omitted.

> So don't put them on the open Internet. That's a valid answer for an audience familiar with computer networking concepts. It's a silly suggestion for consumer IoT customers, who do not understand those concepts. They don't know what is or is not 'on the open internet'; they buy a product at the store and plug it in. > We should have certifications that devices create no outbound TCP/UDP flows. This is the "bury you…

IoT customers by default would not have devices exposed to the Internet. This has been the status quo for decades ever since wifi and NAT became popular. If they don't understand it, it will be secure by default. It would be technically quite easy for either a dedicated home-access box or just the router-AP combo box to have some auto-config wireguard setup (e.g. scan a QR code or install an app that looks for the bo…

> IoT customers by default would not have devices exposed to the Internet. This has been the status quo for decades ever since wifi and NAT became popular. If they don't understand it, it will be secure by default.

Because IoT devices have historically been known as secure? Definitely not. Devices that presume someone else has already configured a firewall correctly often presume wrong. Consumers are not networking professionals.

> It would be technically quite easy for either a dedicated home-access box or just the router-AP combo box to have some auto-config wireguard setup

Well yeah, if everything about home networks was different, then the situation would be different. The problem is, that isn't the reality in which IoT devices are manufactured.

> If regulations pushed for actual security (no-cloud), this would be the obvious solution to market.

If they pushed for this, the only solutions with the sticker would be ones that are commercial failures because they won't work out of the box with the router people actually have at their house. You may be 'right' but your labelling program will have failed. A labelling program has to be realistically achievable within the current reality to have any effect, otherwise it'll just be ignored by manufacturers.

Incremental improvements, such as this, are not bad, even if not perfect. People are going to buy doorbell cameras that connect outbound to the internet, because the technology works out of the box.

Re: White House unveils Cyber Trust Mark program for consumer devices

#126

Post by ndriscoll »

kube-system wrote: post #122
ndriscoll wrote: post #100

Earlier quoted context omitted.

All of those things might have a authentication-free use-case for e.g. a babysitter (maybe not to change settings, but to use). For personal networks, being on your local LAN is in practice a decent form of authentication given the tradeoffs of otherwise having to manage credentials.

That seems a bit contrived. I would expect my babysitter to be observing a child in-person, not remotely. Regardless, the commonly expected use case for IoT devices is for people to be able to access them from their mobile device, on the internet (thus the 'I' in IoT). IoT devices, as their name implies, are on the internet, and need authentication because of this. The problem is that this use case is real, and peopl…

We use a camera in our daughter's nursery to see whether she's going to fall asleep (if protesting a nap/bed time after laying her down) or whether she's standing in her crib/too wound up. We also use it to keep track of whether she's woken up if we're out in the yard. I do actually have the ability to access it over the Internet through wireguard, but that's something I never need. LAN access suffices.

IoT is a marketing term. Networked devices don't necessarily need to use the Internet, and indeed most of the time there isn't even a use-case. You're going to open your garage while you're at the store?

Honestly I don't see the use-case for almost any IoT thing though. It mostly seems like gimmicks (color changing/dimming lights) or adding unnecessary complications that make it less secure and more failure prone so that someone can sell you a service (a cloud app for your garage instead of a remote/keypad, an app for your door instead of a key).

Re: White House unveils Cyber Trust Mark program for consumer devices

#127

Post by jayd16 »

mjevans wrote: post #104
jayd16 wrote: post #90

Earlier quoted context omitted.

Some things to realize about read-only devices is that once they are cracked, they are cracked forever. The devs have dev time to secure the device, the hackers have infinite time to crack it. Once done, the game is up. All instances are now easily exploited. The more popular the device, the more knowable upside to an exploit. If the device can be updated, then usually the exploitable timeframe is limited and its unk…

A really dumb camera that just has an interface that's polled for data by a remote host is more likely to be used in a secure way than a 'smart' camera that tries to remember state and talk to an external server itself.

What you're describing is a completely unsecured device. Any security comes from elsewhere.

Re: White House unveils Cyber Trust Mark program for consumer devices

#128

Post by reverendsteveii »

ndriscoll wrote: post #102
kube-system wrote: post #91

Earlier quoted context omitted.

Most software vulnerabilities aren't intentionally added backdoors, but flaws in the software that shipped on a device. > After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which in a sense are similarly 'read-only'). Quite a lot -- these are some of the easiest devices to hack. The only saving grace is that most of them are not connected to the internet so…

> Most software vulnerabilities aren't intentionally added backdoors, but flaws in the software that shipped on a device. Disagree, it is extremely common for e.g. TVs and smart phones to ship with malware included. In fact it is almost impossible to buy some classes of devices that aren't intentionally compromised. Having the thing never connect to the Internet at all and never receive updates is a far better securi…

> Most software vulnerabilities aren't intentionally added backdoors

>it is extremely common for e.g. TVs and smart phones to ship with malware included

These aren't mutually exclusive. With that being said, I'm probably with you when it comes to the overall debate. For something to get exploited it needs a vulnerability and a means to exploit it. The most insecure device in the world can't be exploited if I'm the only one who ahs the means to do it. Unfortunately we live in a world where Zawinski's Law has itself expanded such that everyone wants to be able to access everything from everywhere, which rules out airgapping a lot of devices. It's a consumer economy - we have to build what people want and then secure it. We don't have the luxury of building secure things and then convincing people to want them.

Re: White House unveils Cyber Trust Mark program for consumer devices

#129

Post by reverendsteveii »

ocdtrekkie wrote: post #103
kube-system wrote: post #94

Earlier quoted context omitted.

Do they require auth and use solid crypto? If not, they are vulnerable, it's just that the vulnerability requires the attacker to be within range. People thought old analog 900mhz cordless phones were fine until others realized you could just tune a radio to that freq and listen to your neighbors.

They're not vulnerable in any way that matters. If you manage to get a device in range you can... turn my lights on and off? You can't program them to do malicious things over the Internet. They don't have any sensitive information you can access. There's no damage you can do them. The problem with saying you need auth and crypto is now you just added a bunch of complexity you have to maintain and update and hence no…

>If you manage to get a device in range you can... turn my lights on and off?

Is that all it's capable of or all you use it for?

Re: White House unveils Cyber Trust Mark program for consumer devices

#130

Post by timewizard »

Bjartr wrote: post #118
timewizard wrote: post #59

Earlier quoted context omitted.

"Find all the information you need to start shopping for ENERGY STAR certified products, including product details, rebates, and retailers near you." So, the product search works like a shopping cart site, and has no historical products, only new ones, and helpfully lists the prices. Who is this meant to benefit?

You want the "Product Specifications & Partner Commitments Search"[0], not the "Product Finder"[1]. Both are available from the top level "Find Products" menu [0] https://www.energystar.gov/products/spec [1] https://www.energystar.gov/productfinder

That just shows specifications. I don't see a way to _confirm_ that the device I currently have in my hands, bearing the Energy Star logo, has actually earned it.
Post reply on HN