So there is a great amount of lists, blogposts and information about awful/bad IoT things, but if someone like me want to have a list about IoT things that are actually secure and well-working, where would I find that?
My general rule of thumb is I NEVER buy anything IoT that is WiFi based. Zigbee or Z-Wave based devices will save you a lot of security nightmares (though definitely not all).
As these devices become more popular, we'll start seeing more Zigbees and Z-wave devices become commodity hardware.
Zigbee has built-in, easy, encryption. You simply set your router to allow unsecured joins temporarily whenever you get a new device, which then learns the key.
When the network is set to allow only secure joins only devices pre-configured with the key can see anything other than encrypted frames.
Of course, wifi has gotten more secure over time to the point that I'd be more concerned about giving the devices internet access than I would about intruders on the network.
In just one highrise project I did in Las Vegas last year we installed something like 65,000 Zigbee devices, and that's not atypical for highrise hotel construction. Zigbee is everywhere in building automation.
Low power: it should not require much in the way of network traffic or heartbeats so that you could leave the radio mostly off.
Mesh networking: ideally the devices should be able to repeat commands so that they could be low-power and not have to broadcast across entire houses.
Secure: it should have specific ways to join a network that don't require a keyboard on the device.
IoT application focused: the protocol should make it easy to do things like turn a device on/off, set a value or read a value.
Z-Wave and Zigbee do these things (for the most part), while WiFi is sort of hacked to try to maybe accomplish it. For instance, my Z-wave thermostat has been running off the same lithium AA batteries for about a year now, and the battery level is at 77%. I can't imagine a WiFi device being able to achieve that.
(It's also much more power-efficient; you can't really use wifi on battery powered devices unless you charge them frequently)
Maybe i'm just being cynical...
F.ex. when's the last time you saw a commercial for a door knob?
Similarly, the home automation solution targeted at those people usually aren't shit cloud-based products.
Perhaps an open-source effort to document & track what work has been done, even if it's just pulling firmware images and taking a look around. Maybe some kind of gamification to motivate researchers to pull things apart and report what they see.
You'd never see a post on the front page of HN about how IoT device X was well designed and is generally secure, but you see (and will continue to see) them top out about how awful they are.
Just look at this thread. Half the answers to "what are some good IoT devices" is "lol there aren't any"... The HN crowd doesn't want good IoT devices, they want to make fun of bad ones.
I've bought everything from wireless hard drives to $250 Wifi routers to $20 ethernet/3G bridges and the quality of the firmware is pretty garbage on all of them.
I see brand new devices on kernel 2.4 and 2.6 with no upgrade plans in sight, and hacked up kernel trees that have no chance of building except on the developers' Red Hat 9 (!) workstations.
http://www.devttys0.com/blog/ is another good place to follow. I guess it's more fun to write a negative article, not to mention it gets a lot more views.
Perhaps a good strategy would be to still offer an interesting read despite a lack of "hey i found epic 0days and hacked everything":
- here's my methodology
- here are some cool ways they made this thing robust
- here is how I tried/successfully defeated the defenses
- some tooling I created to break this thing
Here ya go!
...