Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

news.ycombinator.com

Post reply on HN
Print view View original

721–730 of 944 posts

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#721

Post by leohonexus »

AbrahamParangi wrote: post #712

In an ideal world, IoT and smart device manufacturers would be required to pay for “end of life” insurance. Ridiculous that a company can brick your devices by shutting down their servers and/or going out of business. Some people have suggested forcing companies to open source their software on death so that someone, somewhere might be able to keep the smart devices alive but this is difficult implications for capita…

If a HW company is shutting down due to financial difficulties, the fact they previously paid to get a "license" to make smart devices won't be any incentive for them to continue operating. How does this help the situation other than to further raise the barrier of starting HW companies?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#722

Post by necovek »

paiute wrote: post #690
landemva wrote: post #351

Earlier quoted context omitted.

This sums up the situation that government regulations don't work. These regulations put us on the path of trusting religious-like in government. We could be working toward push-button simple network segmentation with some kind of default filtering for install by the average home user.

I’ve worked in security before and i don’t really think the government should be involved that much. There are so many different situations to consider. What i would support is the fcc coming up with a list of common patterns and then forcing devices to state which, if any, pattern they follow. I have a weather station for example which doesn’t really need any security on the device end.

Does your weather station connect to the internet? (the discussion is about IoT devices)

If so, plenty of IoT devices have been used in botnets, as point of entry into local networks (hello printer, home assistant, file share...), or simply killed off with a DoS attack.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#724

Post by wpm »

hunter2_ wrote: post #656
iandanforth wrote: post #496

Earlier quoted context omitted.

Google's acquisitions of Nest and Dropcam are the two which impacted me personally. Data ended up in the hands of people I didn't want, features were removed that I found essential. Perhaps others can volunteer their stories, I've largely opted out of IoT because of these experiences and concerns.

Suppose you buy a car from manufacturer A. You lose both keys (perhaps you and your partner each bring one on a canoe trip and capsize) so you have no choice but to ask the dealer to assign new ones. You find that Google now owns the entire brand A including its dealer network, and they only offer rekeying service in conjunction with an update that installs what you consider spyware. Do you opt out of the motor vehic…

I opted out of the entire motor vehicle industry for far less.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#725

Post by WaitWaitWha »

Thanks for reaching out to the community.

Instead of mandatory updates, there are lower hanging fruits you can win, and will have just as much, if not more positive security impact.

1. No default password, one must be set at initial configuration

2. Devices must function without public internet connection (unless it is one of the device's primary function to transmit out)

3. Devices must function without centralized host

4. Explicit disclosure of all "phone home" destination hosts, and ability to change or disable this

5. Explicit disclosure what information is transmitted out, and ability to disable this

I think the above five can be implemented relatively easily, requires no continued maintenance from the manufacturers, and improves the CIA triad of IoTs.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#726

Post by necovek »

ezzaf wrote: post #708
MarcoPerazaFCC wrote: post #586

Earlier quoted context omitted.

One my favorite IoT botnet scenarios is an attacker taking control of thousands of ovens/air conditions/other high-wattage devices and using them to cause power outages. https://www.usenix.org/system/files/conference/usenixsecurit... I wonder how the impulse to connect everything to the internet will be remembered.

The flip side of that is you can use control of all those high wattage devices to prevent power outages by shifting load to times when more energy is available. Hopefully, that's how the impulse will be remembered.

Or by the rise of salmonela infections...

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#727

Post by wpm »

vinay_ys wrote: post #177

IoT devices need regulatory standardization w.r.t a few things: 1. software stack – big fat "firmware" should not exist. Entire stack should be upgradable safely, securely and frequently during its official supported lifetime and should be open-sourced for owner's own upgrades past end of life. For this, the hardware stack needs some amount of standards compliance. 2. Vendor should clearly declare/advertise the perio…

In regards to 3.2, I'd like to propose 3.2.1, where a smart device manufacturer must clearly label and explain that A. their device requires a connection to a cloud service, and if so, what for and what data is sent/transmitted, and B. what functionality, if any, remains if you refuse.

I have a Winix air purifier that has a sensor and filter lifetime suite that I cannot communicate with because it refuses to connect to my "IoT" SSID that has no access to the outside internet (no, you stupid piece of crap, my WiFi is working fine, now just start sending data damnit).

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#728

Post by exodust »

atomicfiredoll wrote: post #90

Has much consideration been given to labeling when a third party cloud or paid service is required to use the device? As somebody who uses IoT devices "locally" on my private network, I want to know my data will stay local and protected. The recent issues with Eufy doorbells claiming to be under local control [and encrypting data], but actually sending data to the cloud stands out to me as an example where labeling a…

> required to use the device

The Eufy story was blown out of proportion. Alarmist tech clickbait. There was no requirement to use the cloud. People were misled into believing their Eufy cameras were spying on them, or doing bad things, or easily hacked by anyone armed with the "knowledge" found in the arstechnica story and numerous repeater channels.

Today in 2023, the Eufy cameras are solid, I like how they work. Zero subscription costs, local storage expansion, optional cloud storage, no cloud dependency, and the cameras keep recording if your home internet goes down. If you want thumbnails included in push notifications, then tick the box in settings where is says underneath: "thumbnails will be temporarily stored in the cloud".

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#729

Post by scj »

i_am_jl wrote: post #222
trelane wrote: post #105

Earlier quoted context omitted.

> But sophisticated users who'll take advantage of things like that are only 1% of the market. Most folks can't or won't do lots of things in their lives (e.g. plumbing, electrical, construction, lawn services, Automotive). The main thing blocking routers and IoT devices is the control every vendor wants to hold over their customers' devices after sale.

Even if you give control to the users, it's up to them to use it. I'd argue that the main blocker to IoT security is the lack of culpability on the part of device manufacturers. I don't want to go so far as to suggest that companies should be wholly liable for software bugs, but vulnerabilities that are brought to the attention of the company privately or disclosed publicly absolutely should be their responsibility t…

I'd argue that in an ideal world, a fridge wouldn't have networking capabilities!

Even if I don't buy one, I dread to think of what might happen if enough fridges across the world stopped working all at once (demand for non-perishable food and fridges would skyrocket).

For the sake of consumer safety in our imperfect world, there should be a safe-mode hard switch fallback for any life-critical and/or high wattage device that gets networked.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#730

Post by landemva »

ClumsyPilot wrote: post #654
landemva wrote: post #351

Earlier quoted context omitted.

This sums up the situation that government regulations don't work. These regulations put us on the path of trusting religious-like in government. We could be working toward push-button simple network segmentation with some kind of default filtering for install by the average home user.

> regulations put us on the path of trusting religious-like in government We trust in government to set rules and punish rulebreakers. When that is not true, do we enact punishment ourselves? Results would be not pretty.

If your ISP determines there is a botnet from your home IP and you refuse their request to fix it, then it seems appropriate for your ISP to take action or "enact punishment".
Post reply on HN