Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

apple.com

Post reply on HN
Print view View original

271–280 of 364 posts

Re: Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

#271

Post by Avamander »

AnthonyMouse wrote: post #256
PaulHoule wrote: post #229

Earlier quoted context omitted.

Key exchange for IoT devices is a tricky problem. IoT devices don't support public key infrastructure, e.g. something like GnuPG or the SSL certificates used by web browsers. It's a very practical solution to have a shared secret between the device and a central server, and, at registration time, have the central server make a key for both the hub and the device. Without some kind of key exchange, people could set of…

The solution is to have a pairing mode that allows the device to be paired with a control device (e.g. your phone) via wireless while you're in the same room as it. That would only have to be done once when it's installed and require pressing a physical button on the device while being in wireless range so that nobody can hack it remotely.

Out-of-band pairing is a better idea, e.g. some key on the bulb has to be entered or scanned or read on the device.

Re: Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

#272

Post by smashah »

dorfsmay wrote: post #224
paulgerhardt wrote: post #199

10 years in the trenches here. Apple’s smart home protocol famously does not support multiple users. Amazon is choosy on what features you can implement (turn on alarms but not turning them off, locking doors but not unlocking them). Google loves using radio hardware no one else supports. Zigbee has delightful legacy security vulnerabilities and consortium drama. I look forward to these groups putting aside their dif…

Is there an alternative today, like a de facto standard based on open specs/protocols?

When it comes to smart home tech cost-cutting it's all about simplifying the small-but-many pieces. That's where RF 433 Mhz comes in.

Why should I pay $40+ for a zigbee/z-wave/smart-things/wifi-enabled door sensor when I can get a $35 RF Sonoff bridge and get each sensor for around $4-$8 from china.

So you can save a lot of money by using that tactic with door sensors/window sensors/PIR Sensors/Alarm systems/Sirens/Switches etc. because those will add up massively. You can't use that for TV/Speakers/Cameras ofc but you can bring everything together onto home assistant.

As far as I'm concerned, only the community can decide which protocol will win and these big techs should just put their weight behind a protocol built with the community instead of closed-door-consensus.

https://www.youtube.com/watch?v=OfSbIFIJPuc

https://www.home-assistant.io/components/

Re: Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

#273

Post by zackmorris »

mr__y wrote: post #218
zackmorris wrote: post #176

Earlier quoted context omitted.

Another thing I'd like to see is a distributed shared state standard (not just for IoT): https://en.wikipedia.org/wiki/Distributed_shared_memory https://en.wikipedia.org/wiki/Software_transactional_memory https://en.wikipedia.org/wiki/Consensus_algorithm https://en.wikipedia.org/wiki/Raft_(computer_science) https://en.wikipedia.org/wiki/Distributed_hash_table The current trend of using async logic via message passing…

How would you solve access permissions in DHT? What if a node in DHT holds data that it is not granted to read? This would imply encryption of the data to prevent unauthorized reads - this does not really seem as a complicated problem - the data could be encrypted with only the nodes granted the read access having the decryption key(s). What seems harder to me is write permissions - if the data is encrypted/signed, o…

I'm not sure for DHT. But in Firebase the permissions are handled as user access rules written in Javascript, returning boolean true or false if the user has the ability to read/write the node and if the data being written passes a validation check:

https://firebase.google.com/docs/rules

https://firebase.google.com/docs/rules/rules-language

So Firebase permissions really have more to do with the identity layer than keeping the data secret.

I think that probably everything should be encrypted anyway. This was a largely solved problem even in the 90s, and embedded devices are about as powerful as the 386 and 68030 computers popular then.

We really need a distributed SSL identity layer though. Something like letsencrypt.org except the client's identity would come from the social proof of its peers instead of a central organization. Maybe this is already a solved problem in OpenSSL? I only understand symmetric key encryption, but not the man in the middle protections that SSL certificates provide. To me, p2p identity and encryption should have been a foundational pillar of the internet, not some controversial afterthought like we think of it today.

Re: Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

#274

Post by baybal2 »

xoa wrote: post #237
baybal2 wrote: post #177

Earlier quoted context omitted.

It reminds me of the old "FireWire vs USB." Firewire was an originally open standard, but there came Apple and demanded to exact a symbolic 1$ per device payment. Despite FireWire being an indisputably better standard from technical standpoint, that 1$ completely ruined the mood with OEMs, and they lost the market. USB on the other hand, was not really open, but Intel's central leadership in it guaranteed that there…

> Firewire was an originally open standard, but there came Apple and demanded to exact a symbolic 1$ per device payment. What? Firewire was a project initiated by Apple in mid-1980s, which then was further developed by the IEEE P1394 Working Group. Patents and pooling was part of it from the very beginning, with the primary drivers being Apple, Panasonic, Philips, and Sony (there were also a half-dozen odd smaller co…

1394TA was open as far as I remember

Re: Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

#275

Post by CiPHPerCoder »

samatman wrote: post #269
CiPHPerCoder wrote: post #227

> Apple, Microsoft, Dell, Tesla and Google's parent company, Alphabet are named in the lawsuit The comma misuse is legendary. https://www.amazon.com/Eats-Shoots-Leaves-Tolerance-Punctuat... Fixed: Apple, Microsoft, Dell, Tesla, and Google's parent company, Alphabet, are named in the lawsuit

Wrong thread, you're looking for https://news.ycombinator.com/item?id=21824178

O_O

I posted it in that thread. What the fuck?

Re: Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

#276

Post by Symmetry »

TheKarateKid wrote: post #233
Symmetry wrote: post #170

Earlier quoted context omitted.

There's also the bit where Zigbee devices have to share a secret key to talk to each other, mostly to prevent competition from low cost devices manufactured in China.

> mostly to prevent competition from low cost devices manufactured in China. mostly to prevent competition from patent-infringing clones manufactured in China. FIFY

I actually worked at Ember for a bit before leaving when they get bought by Silicon Labs. The reason, internally, really was the fear that there would be a flood of low quality products that would make ZigBee look bad.

Re: Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

#277

Post by aphistic »

utopian3 wrote: post #2

FYI: This is the project's official homepage: https://www.connectedhomeip.com

It actually makes me feel better about the project seeing Legrand on the list of companies than it does any of the 3 tech companies in the title.

Re: Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

#278

Post by rasz »

Symmetry wrote: post #276
TheKarateKid wrote: post #233

Earlier quoted context omitted.

> mostly to prevent competition from low cost devices manufactured in China. mostly to prevent competition from patent-infringing clones manufactured in China. FIFY

I actually worked at Ember for a bit before leaving when they get bought by Silicon Labs. The reason, internally, really was the fear that there would be a flood of low quality products that would make ZigBee look bad.

as opposed to ZigBee making ZigBee look bad as it stands now. Only big names looking for a lockin pick ZigBee.

Re: Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

#279

Post by Lendal »

giancarlostoro wrote: post #141

I bought a home and the previous owner used Z-Wave for everything. The whole thing worked irregardless of internet working or not. Whatever they invent if it is useless without internet access its a step back from something that has already worked. All my home automation / smart home integrations will have to be Z Wave compatible or I will not use it. If my internet goes out will all my things be useless without it?

Z-wave takes less time to get working and once it does it stays working. I've bought Wifi switches that worked for as little as 2-3 months before dying. I've never had a Z-wave device die. Zigbee maybe be open but if it can't penetrate walls then it's just not worth the hassle.

Re: Amazon, Apple, Google, and the Zigbee Alliance to develop connectivity standard

#280

Post by istillwritecode »

AnthonyMouse wrote: post #256
PaulHoule wrote: post #229

Earlier quoted context omitted.

Key exchange for IoT devices is a tricky problem. IoT devices don't support public key infrastructure, e.g. something like GnuPG or the SSL certificates used by web browsers. It's a very practical solution to have a shared secret between the device and a central server, and, at registration time, have the central server make a key for both the hub and the device. Without some kind of key exchange, people could set of…

The solution is to have a pairing mode that allows the device to be paired with a control device (e.g. your phone) via wireless while you're in the same room as it. That would only have to be done once when it's installed and require pressing a physical button on the device while being in wireless range so that nobody can hack it remotely.

I will no longer install apps on my phone to pair devices. The reason is that then everyone wants to link my phone number to the device and create an account. There is nothing that intrinsically says they have to, but companies cannot resist asking for a unique identifier that happens to be linked to everything else in your life. No thank you.
Post reply on HN