Hacker News Reader

All of those are great use-cases. But do you really want each of those devices to be added to the external threat surface? Perhaps it would be better to have everything talk to a central hub over a local protocol (ZigBee, Bluetooth, etc) and then that hub be the main connection out to the Internet at large. As it is now, it's still a bit of a free for all. And at least if you have a hub model where you can secure that one device (or replace it if it is compromised), you don't have to replace all of your individual IoT devices when something bad does happen.

A good example of this is my garage door opener. Instead of building a WiFi connection into the opener itself, there is a separate little gateway device that sits inside my house. The gateway talks to the door (RF) and to the Internet (ethernet). I can still control my garage door, but if something is compromised, I can always detach that gateway and still have a working (secure) garage door.

It seems so silly to me to not use the ubiquitous "RF" broadcasting stations already in everyone's house, that also includes an "okay" addressing system, a security firewall, high bandwidth communications protocol, and more.

Why not focus on software which can use WiFi more securely and with a better focus on local connectivity? I can understand the "ultra low power" needs, but many of these devices are mains powered, and that's not really a concern.

But yes, what I do right now for the most part is use z-wave which is connected to a central "hub" which is then connected to the outside world. But IMO that's a hacky-workaround for this problem, not a real solution.

This is a great idea, but it would inevitably fail. All we'd end up with is each and every IoT company coming out with their own "hub" product that only works with it's own devices. Want to control Philips Hue bulbs? You have to have a Philips IoT hub connected to the Internet. Belkin smart plugs? They'll connect only to a Belkin smart hub. Xyz Manufacturer sprinkler system? Xyz hub. Oh, and by the way, those hubs will all have insecure software thrown together by an underpaid E.E. too.

OT, but not much, there was a story recently about the Garadget:

https://news.ycombinator.com/item?id=14029572

which shows some of the risks of an internet connected device (no, it is not about lack of security)

If router security weren't such a mess as well, that'd be the perfect integration point. Better home routers already can provide VPN connections, have apps for mobile devices to set those up, can isolate different devices in the local network ("guest WLAN", "child protection" features), ...

At the same time, a lot of IoT stuff only connects to the outside to be reachable by its apps, and maybe sent notifications. The router could manage these things instead, independent of any device-specific "cloud" service.

I do think a large part of the reason so many devices need "internet" access is because we (as developers) have failed to come up with a good way of accessing these things locally.

So many things in my house have static IP addresses because I want to access them locally, it's an absolute pain in the ass and not at all something that your average person could manage.

Having an IoT device send all of it's data to a "cloud" server is the easiest and most fullproof way to make sure everyone can use see it. Without that, you are looking at complicated local addressing systems, hoping that your users aren't using client isolation or something like it (and you WILL get calls because they tried to use the device on a hotel network where each client is isolated and it didn't work), and ugly URLs at best.

By all means, if the Internet connection serves a purpose, great. But a sleep monitoring gadget probably doesn't need an Internet connection just to show your sleep score. For all the flak Fitbit has gotten, at least it gets this right (syncs over Bluetooth.)

You don't need IoT for any of those use cases. For the first two you just need occupancy detection. You can do that locally with passive infrared sensors. And for letting your friend into your garage you just need a keypad lock. They can phone you and ask for the code. If the lock supports multiple codes you can tell them only the backup code so you can change it and lock them out again later without inconveniencing yourself.

>You don't need IoT for any of those use cases.

This is a shitty response. It's like telling the person who wants a better mousetrap to just live somewhere that doesn't have mice. It might be a "solution" but it's not a good one.

>You can do that locally with passive infrared sensors.

So now you want me to purchase 10+ infrared sensors for throughout my small condo? And what happens when my pets set them off? what happens when I'm laying still on the couch? What happens when I'm taking a shower?

I can just get a keypad? what happens when I want to change my keycode while I'm away for a week? What about the nice notification I get on my phone when someone opens a door or the garage door when I'm not home? What about the snapshot of the security camera I have sent to my phone every time someone enters the house when nobody is home? What about the routine which begins warming/cooling my house when i'm less than 15 minutes from home?

Those aren't solutions, they are shitty workarounds that only work in a fraction of the situations. Just like most other "solutions" that attempt to act like every single thing is 100% possible without outside communication are.

PIR sensors are reasonably cheap and have low power consumption. They could be battery powered and connected to a local low-power wireless network (transmitting only, and at low data rate), which would make installation easy. It wouldn't take much battery capacity to beat the expected lifespan of a IoT device. They're generally good at discriminating between humans and pets, but if a pet did trigger it the worst that would happen is you waste a little electricity or fuel as you give it some light or heat you didn't intend to. You stand to lose much more if somebody hacks your internet connected solution. And if you're laying still enough to avoid triggering a PIR sensor you're probably sleeping and want the light off. And most phones are not waterproof so they cannot be used in the shower, so IoT does no better there.

I think it's unlikely that the IoT door lock features add enough security to make up for the increased attack surface compared to the local only version.

The point is that my phone is with me, so If i'm in the shower, the phone isn't 300 miles away, so if the phone says it's home, it's significantly more reliable than an IR sensor which will say i'm not home because i was out of sight for 15 minutes in the shower (or perhaps sitting on the toilet for that time, during which all the lights in my house turn off, my PC powers down, my doors lock, my thermostat goes into "away" mode, the water heater goes into "vacation mode", etc...)

I've had IR light switches before, not only do they have tons of false positives (I ended up removing it because I would roll over in bed and the lights would turn on at 1AM...), but they have a significant number of false negatives (I can't count the number of times i've had to stand up and wave at the damn thing like a crazy person to get it to turn the light on because it shut it off on me when i was sitting reading).

I also have 2 of them as part of my "home automation" system, and they are mostly useless. You say they are good at telling people from pets, but my 2 small cats set them off about 30-50 times a day, and if I point them up to where they don't go off that often any more, they won't go off for people at that point.

And like I said above, this isn't just "turns some lights on for a few minutes", this is turning the thermostat on/off, turning the water heater on/off, lights, locks, doors, tvs, computers, fans, speakers, etc...

And they STILL don't solve the other issues. What about notifications when someone enters/leaves the house? What about pre-heating/cooling the house when i'm close to home? what about external camera access? what about the alerts about water leakage, or gas usage while i'm not home? or the notification that I left oven on?

Why try to "reduce attack surface" of my door lock, when it's feet away from a window? I personally think a lock which sends a notification when used, or IoT devices which notify when used and nobody is home is magnitudes more "secure" than a dumb lock which will do nothing while all of my stuff is stolen.

Telling me I don't need those things isn't a "solution", it's letting perfect be the enemy of good.