All the deeply creepy ones derive their creepiness from cloud tethering-- they transmit everything back to the mothership and can only be used via the mothership. You are putting a microphone, camera, etc. in your house that someone else has absolute real-time control over, and then because it's a "thing" you are going to forget it is there.

Yet every single IoT kit, howto, stack-as-a-service, or other piece of material or IoT startup I see enshrines this as The Way. IoT devices connect to IoT cloud backends and that's how it's done. Period.

There are several reasons:

(1) Vendors desperately want to avoid total commoditization. Competition in the hardware space comes from cheap Chinese vendors with unbelievably cheap labor and monstrous economies of scale. Tethering your device to a backend provides both some amount of lock-in and keeps your secret sauce away from the Chinese reverse engineers. (Or so people think.) This is as true for Chinese vendors as it is for domestic ones-- don't expect them to forgo this strategy when their competition is each other.

(2) There is no good solution for end-to-end transit that copes with the ugliness of endpoint networks.

Full disclosure: I am founder of a company that is trying to address #2 in an open, scalable, reliable, and interoperable way. I am therefore partial to this problem. Yet I also think it may be the easier of the two to solve since it's mostly just a technical problem. Problem #1 is deeply baked into the structure of the market and I have no idea how to solve it. Pathological emergent behaviors like this in complex systems like markets are notoriously hard to fix. You can see the train wreck but you as an individual are helpless against it-- in fact you are almost forced to help drive the train off the cliff because every market incentive points that way. Usually the ham-fisted solution of legislation is the only thing that can address such pathologies in the real world. I hate that as a still-semi-libertarian but it is what it is.

Edit:

It gets worse. Now add:

(3) All kinds of creepy agents from governments to crooks to (perhaps worst of all) quasi-crooked "dark pattern" companies who want to "monetize the user," would love to get as many Internet-connected cameras, microphones, sensors, etc. into your house as they can. It's a gold mine of private data they can do creepy things with. Think about the malware situation on PCs -- that is about to happen to your house.

#1 and #3 obviously interact constructively. The race-to-the-bottom nature of hardware and the ease with which software is copied means that companies must look for any revenue stream they can. We've seen what this has done to the web: the most successful web companies are free services that monetize the user through surveillance. It's hard to imagine that the same economics won't drive IoT vendors to the same endpoint.

Edit #2:

I toy around with the deeply contrarian idea that what we need are significantly stronger intellectual property laws to upend this economic death spiral, but I am not at all convinced that that is the answer or that it would have any chance of working.

The other less radical idea is that this is a marketing problem, and that IoT is ripe for a higher-end vendor to come in and say "we aren't creepy."

Would customers pay twice as much for a genuinely useful or enjoyable IoT device that came with an iron clad privacy policy, open APIs, and direct connectivity so you could avoid any cloud dependency? The conventional wisdom that I hear endlessly repeated is "customers don't care about privacy or security." I see evidence of this myself -- e.g. not a single user out of many thousand has asked us (ZeroTier) about the quality of our crypto. "It's end to end encrypted!" With what? A software implementation of a cereal box cipher? Nobody cares. Yet I wonder: just how creepy do you have to get before people start caring? Do people care when Barbie is listening to their children? When their Amazon Echo is submitting the sound of them having sex to Amazon? How pitifully abusive and downright gross does our relationship with "the cloud" have to get before people actually start caring whether their doors are locked?

Okay enough rant -- back to work trying to put a dent in this problem in a way that's probably more effective than posting to HN. #1 might be the harder of the two problems but if #2 isn't solved there is no chance of #1 being addressed.