Hacker News Reader

Comment by Feneric | Hacker News Reader

IoT devices can be fine, but there are lots of companies involved in it that don't know what they're doing and would be better off staying out of the market. I always advice friends / family to look for upgrading capabilities, ability to do useful work when not connected to the Internet proper, user control (do you own this device or effectively borrow it per licensing etc.?), and other similar things before purchasing any IoT device. Some IoT devices are great, but some are abysmal.

View on HN

And it sounds like this one was like 80% of the way there. I mean they used encryption (badly, but they still used it), had a way to update the software on the device (even if only over http), and uses passwords (although doesn't enforce them).

So everything it does, it does badly? To me, that's not 80% of the way there, that's more like -80%.

Come on, the last thing he reviewed sent everything in plaintext, had no root password, called out to multiple chinese servers, ran ssh via a hardcoded password that was something like a simple word, and didn't have any way of actually updating the code on the device. Oh, and it barely even functioned as a lightbulb...

This is lightyears better than that, and yeah they fucked up a bunch of stuff, but it at least shows they tried. Even shitty AES is going to increase security over plaintext...

Agreed. It may not be technically good, but it's as good as the door locks that hundreds of millions of people rely on to protect their homes every day. Most home doors/deadbolts are easily pickable with a few weeks' practice.

It keeps honest people honest.

I somewhat agree. Since it's only a plug, if the worst that a hacker can do is turn your plug on and off, it's not the end of the world.

But if there is a vulnerability that lets someone use this plug to pivot an attack on the rest of your machines in your network, now it's a big fuckin deal.

"Cheap mass market product of mostly unknown provenience" and "in my WiFi network" are simply two things that do not fit well together.

Reply on news.ycombinator.com