Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet of Crappy Things

blog.kaspersky.com

Post reply on HN
Print view View original

61–70 of 95 posts

Re: Internet of Crappy Things

#61

Post by bhayden »

amirmc wrote: post #20

The push is that all devices will end up connected as commodity manufacturers continue to search for 'value-add' services (even if that value is dubious). In a few years, I wouldn't be surprised if 'smart TVs' were the only ones available. Security also becomes an afterthought as companies rush to get products in the market. This is mainly because the components used to build software rarely take account of security/…

Looking forward to the day I can start calling televisions "telescreens" as they "anonymously" record their environment (unless, of course, the NSA gives Samsung a blanket warrant).

Re: Internet of Crappy Things

#62

Post by ryandrake »

greggman wrote: post #12
swombat wrote: post #4

I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…

I agree with the sentiment but do you really trust the government can actually audit some giant codebase? The internet of things really includes your computer and your PS4 and every piece of software on them. It includes your router and your printer and your IP cam that's basically the same thing as your router with camera attached. I don't know what the solution is but I really can't imagine a government body able t…

I would trust the government to do the things it is good at: regulation, enforcement and penalties. They can contract away the code auditing, security reviews, penetration testing, etc.

The government is needed because the free market provides no real way to hit back at companies that harm customers with defective products. In an ideal world, customers would boycott companies that misbehaved, but in reality this never happens. Victims simply do not stop doing business with companies that victimize them. Last time I checked, my local Target and Home Depot were chock-full of customers, despite their demonstrated inability to handle their customers' data securely.

EDIT:

And, it would be the FTC, not the FCC who would apply such regulation. Indeed, they already list Privacy and Security as within their power to regulate: [1]. In fact their site even has a section dedicated to Internet Of Things: [2]. The problem seems to not be that they are uninvolved, they simply seem to have no teeth.

1: http://www.ftc.gov/tips-advice/business-center/privacy-and-s...

2: http://www.ftc.gov/tips-advice/business-center/guidance/care...

Re: Internet of Crappy Things

#63

Post by ianhedoesit »

draven wrote: post #53
jdhouse4 wrote: post #7

There are two things that can break IoT, security and fracturing. But security is a necessary condition for IoT to succeed. I know Apple has surprised many of the companies that want to work with HomeKit with its security requirements. I heard from one company that, for example, was upset that locks cannot be remotely activated. The last thing anyone needs is their house getting hacked and robbed as well.

Remotely activated locks? What's the use case for this? Call your girlfriend when you're locked outside your house and ask her to open the door with her cellphone? There seems to be a high risk for little benefit, or perhaps I don't have a lot of imagination.

I would imagine it was more of the opposite scenario. Rather than calling your girlfriend when you forget to lock your house, you might want to just lock it remotely.

Re: Internet of Crappy Things

#64

Post by jkestner »

ianhedoesit wrote: post #63
draven wrote: post #53

Earlier quoted context omitted.

Remotely activated locks? What's the use case for this? Call your girlfriend when you're locked outside your house and ask her to open the door with her cellphone? There seems to be a high risk for little benefit, or perhaps I don't have a lot of imagination.

I would imagine it was more of the opposite scenario. Rather than calling your girlfriend when you forget to lock your house, you might want to just lock it remotely.

That goes back to what someone else questioned: Should we not address the problem more directly with devices that take action themselves? All we've done here is move the interface off the physical object. Not much in the way of actual smarts. Requiring an owner to take action on a smartphone is a transitional phase.

Re: Internet of Crappy Things

#66

Post by superbaconman »

swombat wrote: post #4

I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…

This is not a good idea. Now every time a want to sell a minor piece of connected hardware not only will I need a security professional on my team, but I'll need to pay someone (government approved) to audit my work. I want nothing to do with such laws.

Re: Internet of Crappy Things

#67

Post by noonespecial »

swombat wrote: post #4

I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…

This will result in only huge companies that can afford a bunch of paperwork and liability insurance being able to sell the same old insecure things while no one else will be able to afford to challenge them with actual secure things.

As usual it will become more about permission than proficiency so we'll predictably end up with corruption instead of competence.

Re: Internet of Crappy Things

#68

Post by pjc50 »

superbaconman wrote: post #66
swombat wrote: post #4

I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…

This is not a good idea. Now every time a want to sell a minor piece of connected hardware not only will I need a security professional on my team, but I'll need to pay someone (government approved) to audit my work. I want nothing to do with such laws.

I'm hardly a massive exponent of this kind of thing, and I've complained about CE/WEEE/RoHS in the past; but I think the general idea of some minimum product standard is a good one (with a clear "hobbyist" exemption).

If you don't have a security professional to hand, how do you or I know your IoT thingy isn't going to turn into a malware vector?

But I agree that governments don't have a great track record on setting the correct standards. Cameron was only recently talking about a ban on non-backdoored communication.

(Note that CE supports self-certification, it just has very unclear and lengthy rules)

Re: Internet of Crappy Things

#69

Post by Torgo »

jknightco wrote: post #39
amirmc wrote: post #20

The push is that all devices will end up connected as commodity manufacturers continue to search for 'value-add' services (even if that value is dubious). In a few years, I wouldn't be surprised if 'smart TVs' were the only ones available. Security also becomes an afterthought as companies rush to get products in the market. This is mainly because the components used to build software rarely take account of security/…

- "In a few years, I wouldn't be surprised if 'smart TVs' were the only ones available. " To your point: when I purchased a new TV last year, the only available "non-Smart" models were of generally inferior quality to the Smart models, from picture quality to physical design. I ended up purchasing one simply because it was the best TV at its price point—I had no interest in the "Smart" features.

My TV isn't even "smart" but it has a USB port used for doing system updates (there's been exactly one in years.) I did some very basic investigation on the firmware update and could see it had busybox. It got me thinking. I'd settle for a TV where the firmware could be replaced.

Re: Internet of Crappy Things

#70

Post by nmrm2 »

amm wrote: post #44
sgentle wrote: post #2

I wonder if this might be the push that functional programming + formal verification needs to hit the mainstream. Compare Erlang, for example, which must have seemed needlessly complex and theoretical outside of modern super-horizontal-scale computing. I understand that NASA, the #1 in "if this code breaks we all lose our jobs" driven development, are big into formal methods. I think applying that same rigor to smart…

The formal verification subject is tricky. For a lot of software (especially in the web startup world) it is often not possible to hire someone trained in formal methods to perform extensive checks/proofs on software which undergoes rapid change as the company pivots every couple of months. Functional programming alone doesn't give you any guarantees about safer or more correct software than any object oriented langu…

I think with security (and esp. privacy), the problem is more coming up with the specs in the first place. If you can do that in a reliable way, designing appropriate static analyses is probably doable.
Post reply on HN