Hacker News Reader

Comment by fabian2k | Hacker News Reader

With a smart TV there's at least the option to just switch to an external device and ignore the entire smart part of the TV. You're not really in a worse place than if you had bought a non-smart TV (unless the smart TV software actually breaks in some way that interferes with regular operations, which isn't entirely unrealistic).

But in many other cases of smart devices where the core function relies on external services, they'll be entirely useless.

View on HN

Smart TV software can and will interfere with regular operations. My girlfriend's dad got a shiny new Smart TV for Christmas a few years back. He also lives in the sticks and has satellite internet that works maybe every other day.

I volunteered to set it up, and what do you know -- the "OS" was gated by a registration / sign in screen. So, no way to access core functionality (including external inputs, settings menu, etc.) without an internet connection. Even if there was some strange ritual that would let me get through (there wasn't), the average user is fucked.

What make is this? Just for future reference so I know to never buy a TV from this manufacturer!

Not exactly. Keep in mind the UEFI debacle with both Intel and AMD. Having an unknown attack vector on an old TV is less than desirable.

Aside from privacy, I like to think of it similar to musical keyboards. Back when synths were primitive, it made sense to buy a keyboard that had builtin speakers, synthesizer software/hardware - a smart keyboard if you will. Nowadays, the only thing you would want is a good set of keys. That means a midi controller with a baby grand/grand like keybed. [1] Best of all, it should be a lot cheaper than an all in one. And itll be just as good in 20 years as it is now - youll just run a different synth on your computer. All in ones dont make sense for many things. It may be a trend but its an overzealous and oversold one. Ill stick with my dumb midi instruments and my dumb projector. And hopefully theyll still be with me in 5 or more years.

[1] https://en.m.wikipedia.org/wiki/Fatar

I can just pull the network cable from the TV, which removes pretty much the entire attack surface.

The problem with the Link is more or less "devices" that rely on the network for core functionality. So I'm not sure that a smart TV is the best parallel, as most of them from what I know will work without the Internet.

To go with the music world, the best parallel would be the increasingly annoying tendency for music software to move to "cloud" based offerings or other Internet authorization techniques. For instance Roland, with their "cloud plugins", apparently thinks all music venues have super spiffy wifi, as they require network authorization every time the plugin loads in the DAW. (https://www.rolandcloud.com/faq#FAQLink17) If Roland ever pulled this authorization scheme, poof, your plugins no longer work.

I have a 16 year old keyboard (Alesis Andromeda) and a synth that is a bit over a quarter of a century old (Roland D-50), and they both work fine more or less (a few issues here and there but nothing that stops me from using it). They don't need an Internet connection just to work. The companies can discontinue support (or even go bankrupt, in Alesis's case), and the synths still work.

Personally, I certainly do not have great confidence that the Roland Cloud authorization service will last a quarter century.

Hardware that requires the Internet to work is no different than software that requires the Internet to work, it honestly is a risky prospect for longevity. The Harmony Link from what I see was released in 2011. Maybe 7 years is a long time in this current disposable electronics world, but it doesn't feel like that to me.

A do not put any wifi credentials into the TV. Ever.

It will forever try to login into that wifi network, even if you disabled the wifi in the tv ui.

You're going to need to be more specific. Even if there was a TV that did this, you can't generalize and say that all TVs do it.

In my case, it was Samsung UE46F5570.

Sure, all TVs will probably not do that, but before this one it wouldn't occur to me, that it could do that.

Lesson learned.

I don't use the smart features of any tv either, mostly because the smarts evolve faster than my tv will and I'd rather just plug them into the TV, or through a receiver.

What about the ones with wireless connectivity and no hardware kill switch for it?

The smart TV can't log into a WiFi network when it doesn't know the password. And I don't think that there are any smart TVs with an embedded mobile phone data connection that you can't shut off.

My neighbor might run an unsecured network. Poorly designed software in a smart tv might cause my device to auto-join an open network. In this case, locking down my own WiFi would be irrelevant to the television.

This type of behavior was the cause of new Apple Watches that couldn’t access the net over 3G (they were trapped on captive WiFi networks with no UI to disconnect). If this happened with one device, it could happen with others.

edit: split a run on sentence

Every smart TV has WiFi. Even if you switch WiFi off, its not always off, on many devices.

Even if wifi isn't truly off, as long as it's not authenticated to a wifi network before it's turned off it is a measure more safe. If it looks for open networks... that's another thing.

I hate playing the "idiot, its obvious. downvoted" target. HN can be so vicious at times when you would expect someone else to fill in the junior level details. I guess my lesson is to include even the simple blackhat explanations. HN is probably lacking of that kind of crowd...maybe to a boon.

Anyhow, you are all wrong to disagree with me. There were just CVEs for radio chip exploits a couple of days ago! These have been coming out quite often lately. The layer at which these exploits can be done does not require the TV to be on any network. Not even ad-hoc. Just the fact that it has a listening radio chip that has old firmware is enough to make it extremely dangerous [digitally.] That TV can literally became a wifi enabled worm distribution center, infecting everything in your home. Not worth the risk IMO. I would stick with a dumb TV.

"targets didn't have to connect to the attacker's Wi-Fi network. Simply having Wi-Fi turned on was sufficient to being hacked."

[1] https://www.google.com/amp/s/arstechnica.com/information-tec...

I didn't downvote ya. Nor did I get any upvotes on this comment. You have a number of valid points - I wasn't aware of any issues if wifi is disabled.

Dumb TV's with sufficient quality are becoming harder and harder to find. I prefer to plug in my own smarts to TV's since they evolve quicker than the years I'll own a TV.

True - projectors should be easier to get as dumb devices. I have a wired Epson projector that provides 4k.

Unless you paid a premium for the "smart" features.

My understanding is that it costs the manufacturer something like $5 difference to put what's essentially a Roku into a TV to make it "smart" (which kind of makes sense as you can buy a Roku stick for $30 retails and it has to have a case, cable, box, external hdmi connector, power etc.).

The manufacturer then sells the smart tv at a $25-50 premium over the dumb version and it's a decent profit for them.

FWIW - I was always skeptical of the onboard TV smart features, but the Samsung TV that I use a computer monitor actually is actually surprisingly decent.

Could you please specify what model of Samsung TV?

It was the 2016 model of this:

https://www.amazon.com/Samsung-Electronics-UN55MU6500-Curved...

As an aside, I absolutely love using it as a monitor hooked up to a MBP.

But you probably didn't since at this point it's difficult to find a high end TV that doesn't have some crappy OS built into it.

Reply on news.ycombinator.com