Hacker News Reader

> If someone hacks my light switch all they can do is turn the light off and on

Or maybe they can monitor your light switch without changing its state. That data could be used to estimate when you are home with reasonable accuracy.

Or maybe they don't care about you at all and simply use your device in a DDoS or as a relay in an attack on someone else.

Lights are normally visible from outside the house...

So? Observing from the outside would require local observations, which increasingly is tracked (ALPR, CCTV). With a network attack the knowledge can be gained (in bulk!) with a lot less risk. Monitoring many lights (even those not visible from the street) in hundreds of houses without the risk of creating a local data trail is very different than driving by a few houses and observing for yourself.

However, that's just one way an insecure device could be abused that uses the data we know is available. I'm sure there are subtle and clever ways to abuse these devices that are still unknown.

Why would anyone possibly care that someone knows what the state of their lights are from far away? We care because of something that happens locally; burglary.

>I'm sure there are subtle and clever ways to abuse these devices that are still unknown.

The security of residences as fairly well understood at this point. The attacks have been occurring for centuries. My point is that we can't treat this as an IT problem. We have to take the old cultural knowledge into account as well.

> If someone hacks my light switch all they can do is turn the light off

That depends. If your light switch runs an out of date stack, it can be compromised and used as a beachhead to attack other things on your network or to run whatever software they want.

I think you have illustrated exactly why the IoT is becoming such a huge problem for the world at large.

Neither a toaster manufacturer nor the end-user care at all whether the manufacturer hooks a device to the toaster which gives them some bragging rights but can be used to bring down some portion of the Internet when it's security fails.

This is called an "externality" by economists[1]. Similarly to pollution, it's an effect whose cost is not born by those who produce or who consume a given product. And it pretty much require regulation to stop, though the chance of regulation in the present environment seems rather small.

[1]https://en.wikipedia.org/wiki/Externality

This is called an "externality" by economists

Yes, and it's been a problem for well over a decade. E.g. a while ago the clowns at D-Link decided to hammer NTP servers, then had the chutzpah to call it "extortion" when one operator attempted to get them to stop. https://www.lightbluetouchpaper.org/2006/04/07/when-firmware...

Of course the "internet of things" is kind of a joke right now. What with the lack of any sort of standardization it is unlikely that the owner will be able to usefully control things much less some remote attacker.

Unless the attacker doesn't want to use the IoT device for its usual purpose, but instead as, say, a vehicle for a DoS attack, or an attack path into other devices connected to the same home network.

We just do not need any IoT, standardised or not. Our private information must stay in our homes. It is just that simple. I am not saying that we do not need smart homes (they keyword you are looking for is "home automation"), just these do not have to leak our private information out of our homes. Our home is our final stronghold.

Please be wise.

I looked into electronically controlling the lights in my house 15 years ago. I was hard pressed to see any value in it. Walk into a room, flick it on. Walk out, flick it off. The light is for the person in the room - why flick it on and off when nobody is there?

(Yes, I know about deterring burglars.)

I think the biggest change in the past year (vs. 15 years ago) is the ability to interface with products like Amazon Echo and Google Home.

It's very convenient to be able to control lights from anywhere in the room by issuing a voice command. Not just turn them on and off but also dim, change colours, etc.

Granted this is from the perspective of living in an apartment :)

I can absolutely see this if one has mobility problems. If not, it will likely hasten the day when mobility problems arrive :-(

Haha maybe!

My roommate has an extremely annoying habit of leaving lights on, despite constant reminders of "hey turn off the light." We otherwise get along pretty well, so it wasn't worth fighting over. So I modified the switch to add remote control using a simple wifi controlled switch and also added a motion detector. Now the light turns itself of. Sure it's overkill, but it really is convenient and made for a fun project, plus it only cost about $10.

Similarly, our HVAC puts out most of its air upstairs and we use a fan to help move air down the stairwell. I set it up to coordinate with the HVAC to turn on and off in time with the cycles and also to turn itself off in the evening when we are all asleep and back on in the morning. Again, not essential but fun and handy.

The HVAC itself is also controlled by a somewhat complex system that I made over the course of about 6 months. It makes a big difference in keeping the house temperature even and also saves something like $10 per month in electricity. My point here is that well targeted smart home devices can be really handy. On the other hand I made this stuff myself specifically tailored to my needs. IMO, it's hard for commercial products to really hit the sweet spot between being easy to use and yet adaptable enough to fit into everybody's life tightly enough to not be annoying.

LED lights consume not much power. How does that compare with the power used by a wifi + motion detector system running 24/7?

It's pretty clear that an HVAC system that is on a timer can save considerable power. I have a programmable thermostat for that reason, but the user interface for it is so awful I need to reread the manual every time. It would be better if it was wifi and presented a web page as a UI.

I also bought a programmable cat feeder. Again, one needs a manual to figure it out. What is wrong with those engineers? You shouldn't need a freakin' manual to set up a cat feeder. And the UI couldn't be satisfied with 5 buttons, no, you've got to do chording and hold buttons for various amounts of time to do various things. It's complete madness.

(I don't want the cat feeder hooked to the internet, though. I'm suspicious the cat has been plotting against me, and it might be able to coordinate with other cats via the cat feeder interface, which could spark the cataclysm.)

> LED lights consume not much power. How does that compare with the power used by a wifi + motion detector system running 24/7?

It's barely a rounding error. Sleeping the microcontroller, average current draw is a couple mA. LED lights draw around 500 mA.

Regarding the HVAC, what I made is more focused on keeping the temperature balanced by taking a weighted average of temperatures across the house, with the weights adapting to where people are, similar to the Ecobee thermostats but DIY. It also has a web interface where you can view temperatures and power usage, which is far more useful than I thought it would be.

Or maybe they can attach your lightswitch to a botnet and use it in conjunction with millions of others to launch a DDoS.