Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White House unveils Cyber Trust Mark program for consumer devices

nextgov.com

Post reply on HN
Print view View original

141–150 of 164 posts

Re: White House unveils Cyber Trust Mark program for consumer devices

#141

Post by ndriscoll »

kube-system wrote: post #138
ndriscoll wrote: post #136

Earlier quoted context omitted.

Don't automatic pet feeders run on timers? And vacuums run on a timer + sensors? And thermostats run on a timer + sensors? I'm not seeing why any of those would be on a network, much less the Internet. In order to put them on a network in the first place, you'd need to have a way to configure it locally (e.g. bluetooth), so why wouldn't you just set schedules there? The whole point of automation is that you set it up…

> Don't automatic pet feeders run on timers? And vacuums run on a timer + sensors? And thermostats run on a timer + sensors? I'm not seeing why any of those would be on a network, much less the Internet. The ones that are on the internet also allow you to trigger them remotely, monitor status, trigger automatically based on geo-location, etc. Are you trying to say that people could do things another way? Of course th…

It's more that if you are at all concerned about security, then by far your biggest threat to worry about is the provider of cloud services, so that needs to be your starting point. In practice, any home network in the last 20 years is behind a firewall that blocks incoming connections unless you go out of your way to open the firewall/forward ports, and will be secure from other attackers by default. There's no point in discussing security if your threat model is completely wrong.

It's not random hackers in Russia that rendered people's solar setups inoperable. It's the inverter company using their backdoor. Ubiquitous backdoors and pre-bundled malware are the top security problems in the industry.

Re: White House unveils Cyber Trust Mark program for consumer devices

#142

Post by kube-system »

ocdtrekkie wrote: post #140
kube-system wrote: post #139

Earlier quoted context omitted.

I understand your point, it's just not relevant. Consumers aren't doing any of that, nor are they going to. Expecting consumers to buy smart-home devices as a whole system and integrate it into their structure is just not practical. The barriers to entry are too high. I'm glad you bought up Insteon. They're a great example of this, they failed commercially. https://www.pcmag.com/news/smart-home-company-insteon-shuts-…

I mean, fwiw, Insteon is in business today as a new entity. They're producing new hardware and all. It's viable enough a technology to have survived business issues that killed the company. I disagree with your assumption you understand consumers: Many prefer to buy all products from unified systems, and the complaints about how disconnected and disjointed having odds and ends are have led to Matter, which is struggl…

Yeah, people have gripes about all kinds of things that are commercially successful. A status-quo with a gripe is no less the status-quo.

It is a fact that all of the top selling devices in this market overwhelmingly connect to WiFi directly.

e.g.: https://www.amazon.com/Best-Sellers-Smart-Home/zgbs/smart-ho...

Re: White House unveils Cyber Trust Mark program for consumer devices

#143

Post by kube-system »

ndriscoll wrote: post #141
kube-system wrote: post #138

Earlier quoted context omitted.

> Don't automatic pet feeders run on timers? And vacuums run on a timer + sensors? And thermostats run on a timer + sensors? I'm not seeing why any of those would be on a network, much less the Internet. The ones that are on the internet also allow you to trigger them remotely, monitor status, trigger automatically based on geo-location, etc. Are you trying to say that people could do things another way? Of course th…

It's more that if you are at all concerned about security, then by far your biggest threat to worry about is the provider of cloud services, so that needs to be your starting point. In practice, any home network in the last 20 years is behind a firewall that blocks incoming connections unless you go out of your way to open the firewall/forward ports, and will be secure from other attackers by default. There's no poin…

> It's more that if you are at all concerned about security, then by far your biggest threat to worry about is the provider of cloud services, so that needs to be your starting point.

I don't necessarily agree with that. The most widespread and issues to hit people in the US in recent years are not malicious cloud providers, but credential stuffing attacks against otherwise legitimate and reputable services.

> In practice, any home network in the last 20 years is behind a firewall that blocks incoming connections unless you go out of your way to open the firewall/forward ports, and will be secure from other attackers by default.

Right, the instructions with those legacy IP cameras instructed users to open ports to access them remotely.

> It's not random hackers in Russia that rendered people's solar setups inoperable. It's the inverter company using their backdoor.

Yeah, that's a problem. But probably not addressable through this program. There's nothing a voluntarily labelling program can do to protect you from a vendor that wants to fuck you over. One would presume a bad actor would simply: not volunteer to give up their ability to be bad.

Protecting customers from vendor abuses is not just a cybersecurity problem, it's a warranty and contract problem (or criminal fraud problem), and is probably better handled that way.

Re: White House unveils Cyber Trust Mark program for consumer devices

#144

Post by sebastiennight »

floxy wrote: post #16

Seems like good fodder for a tongue twister. Try saying it 10 times fast: - Must the Cyber Truck (Musk) bear the Cyber Trust Mark?

Hmm as a tongue-twister it lacks twists and has too many extra sounds.

I'd suggest something like:

Most Musk Cyber Trucks metrics trick Cyber Trust Mark's trust

Re: White House unveils Cyber Trust Mark program for consumer devices

#145

Post by extraduder_ire »

saltminer wrote: post #45
kube-system wrote: post #32

Earlier quoted context omitted.

You might be getting a bit too far ahead of where the industry is at with some of those wishlist items. NIST's requirements are things that are best practices that everyone agrees with, like: * data stored/transmitted is secured by some kind of means * the device supports software updates * the device requires users to authenticate * the device has documentation * you can report security vulnerabilities to the develo…

> But for now, you can presume the Netflix button on your TV remote can't be configured to point to an alternative API if Netflix goes away. :) At least for Android TV devices, Button Mapper works for some. https://play.google.com/store/apps/details?id=flar2.homebutt...

Whoever made the decision to make Intents work the way they do on Android made a really good choice. It's remarkable how much you can customize and replace different pieces of software on an android device.

Re: White House unveils Cyber Trust Mark program for consumer devices

#146

Post by TeMPOraL »

kube-system wrote: post #98
TeMPOraL wrote: post #69

Earlier quoted context omitted.

The software update angle has already been commented on, but I'm not sure this one is a good idea either: > the device requires users to authenticate

No, it is a good idea. If someone is operating or changing settings on your baby monitor, doorbell camera, garage door opener, smart switch, light bulb, etc -- the developer should check to make sure that the actor doing so is authorized to do it. Why in the world would anyone want unauthenticated access to these devices?

> If someone is operating or changing settings on your baby monitor, doorbell camera, garage door opener, smart switch, light bulb, etc -- the developer should check to make sure that the actor doing so is authorized to do it.

There is a well-established pattern for this that's as old as humanity itself: if you can physically reach the device, you can operate the device. Security is established by the fact that you have to be authenticated and authorized to be in the same room as the device, and if extra security is needed, then various social, physical and digital forms of keys and interlocks exist.

This naturally extends itself to operating networked[0] devices too - if you can get on LAN, you can access them. Yes, I know this doesn't exactly fly in an office, but see the keys&interlocks stuff above. And despite what security people would say, you don't need anything more than that for home (or even SMB) use. Your IoT lightbulb does not need bank-level[1] security[2].

Nor does your non-Internet connected lightbulb or fridge. Which is kind of the other point I wanted to make: non-networked devices neither need nor should go beyond the centuries-old "can reach it = can use it, +/- social norms" pattern; this means we also need to actively discourage the problem-pattern that's common today, and goes like this:

1) Connecting a device to Internet for dubious, often user-hostile reasons, then

2) Bringing up NIST security requirements and implementing them, then

3) Turning around and using all that security work to justify the Internet connection.

No, your device does not need automatic OTA updates. That's just sleight of hand - what it actually needs is to not be connected to your servers in the first place - then all the security requirements are no longer requirements.

--

[0] - Not Internet. I in IoT is bullshit 99% of the time, remaining 1% of the time it should be handled by a VPN - or even a Home Assistant instance, since 100% of IoT apps are bullshit and are better replaced with Home Assistant app + whatever vendor integration for HA the community hacked up in their free time.

[1] - Ironically, banks actually suck at this, but the analogy makes sense in theory.

[2] - Almost nothing does; we're currently dealing with runaway over-securing of everything digital, because everyone and their dog thinks their app is Special and their service is Important. News flash: it isn't. All this is doing is making software and hardware more annoying to use and footgun-rich - and of course entrenching the adtech surveillance business model.

Re: White House unveils Cyber Trust Mark program for consumer devices

#147

Post by ngneer »

amaterasu wrote: post #66
ngneer wrote: post #65

Who are these UL Solutions? They seem to have come out of nowhere and hit the jackpot, inserting themselves as arbiters for security. Smells a bit like how Common Criteria proffered independent certification labs, which were no panacea either.

Underwriters Laboratories, UL. Look at the back of pretty much any mains powered device and you'll see their mark. They were founded 130 years ago, and test and warrant devices (typically high voltage) to be safe. Security is a new thing for them, but they're well suited to provide the services.

Thanks for that context, quite interesting and very much appreciated. I ought to have looked them up proper, but their name is unrecognizable in the security scene.

I am not sure I understand why UL are "well suited" to provide these services. Is it that they have a compatible business model? I do not see how 130 years of solid experience in one domain means (much of) anything for an entirely different domain. Sounds like they have a nice round 0 years of experience in security. To make a crude analogy, this is like telling CERN to go start building spaceships. I mean, CERN has a proven track record for building complex things, right?

Re: White House unveils Cyber Trust Mark program for consumer devices

#148

Post by Bjartr »

timewizard wrote: post #130
Bjartr wrote: post #118

Earlier quoted context omitted.

You want the "Product Specifications & Partner Commitments Search"[0], not the "Product Finder"[1]. Both are available from the top level "Find Products" menu [0] https://www.energystar.gov/products/spec [1] https://www.energystar.gov/productfinder

That just shows specifications. I don't see a way to _confirm_ that the device I currently have in my hands, bearing the Energy Star logo, has actually earned it.

Oh, I see where I misunderstood. I agree there doesn't appear to be a built in way to check, given a label, that the label is legit.

However, I was able to at least verify the label on my dishwasher by doing a google search for `site:energystar.gov ` and seeing that that model comes up in the search results.

After some more digging around I think the expectation is that the trust would stem from an assumed effectiveness of the FTC to squash materially misleading advertising. Though even that needs someone to first notice a discrepancy and bother to look into it.

Kinda like how we trust that the nutrition information box on food is accurate because anyone selling food that falsifies that is going to have a bad time when the FDA comes knocking.

Is it possible to find sketchy products? Yeah, but there's often signs they're sketchy. If it's a concern for you, stick to large, established brands from large, established retailers. They're getting scrutinized up down and sideways for this kind of stuff.

Re: White House unveils Cyber Trust Mark program for consumer devices

#149

Post by kube-system »

TeMPOraL wrote: post #146
kube-system wrote: post #98

Earlier quoted context omitted.

No, it is a good idea. If someone is operating or changing settings on your baby monitor, doorbell camera, garage door opener, smart switch, light bulb, etc -- the developer should check to make sure that the actor doing so is authorized to do it. Why in the world would anyone want unauthenticated access to these devices?

> If someone is operating or changing settings on your baby monitor, doorbell camera, garage door opener, smart switch, light bulb, etc -- the developer should check to make sure that the actor doing so is authorized to do it. There is a well-established pattern for this that's as old as humanity itself : if you can physically reach the device, you can operate the device . Security is established by the fact that you…

The scope of the initiative in TFA is internet connected devices. The devices I am speaking about are the ones relevant to this.

Re: White House unveils Cyber Trust Mark program for consumer devices

#150

Post by mjevans »

jayd16 wrote: post #127
mjevans wrote: post #104

Earlier quoted context omitted.

A really dumb camera that just has an interface that's polled for data by a remote host is more likely to be used in a secure way than a 'smart' camera that tries to remember state and talk to an external server itself.

What you're describing is a completely unsecured device. Any security comes from elsewhere.

Precisely. The camera is not the Security SYSTEM. It should be an unthinking, and thus difficult to corrupt or abuse, sensor for a security system.
Post reply on HN