NoT: Taking the ‘Internet’ Out of IoT
pentestpartners.com
pentestpartners.com
My issue with IoT stuff isn't that it's on my WiFi network. That's great, that means I can interact with it easily.
My issue is that it's communicating with (and often, ultimately, controlled by) a mothership that is somewhere out there on the internet, that I'm not in control of and can't interact with easily.
Having the devices communicating with the mothership using mobile data just takes even more control away from the device owner, which is a step backwards IMO.
The way to make these things secure is to have them on the WiFi network but not speaking to the outside internet, except where explicitly enabled by the owner.
Maybe some kind of standard local server you could run with an easy module API for adding new kinds of devices? Is that what things like Samsung's smart things hub already does?
Consumes would be presented with a QR code on the packaging, and it would take them to the "appstore" for the device
It's ridiculous that every webcam, doorbell, etc requires persistent internet connectivity and cloud hosting of whatever. It's a legal risk (I don't want persistent surveillance of my door in the custody of a third party), financial risk (Eero just laid off 40 people, will my wifi work next year?), and general lousy idea imo.
And, no, "software updates" isn't going to sell anybody on anything because current appliances already work without getting software updates. The only new reason many of these devices would need updates is because they're insecure devices on an Internet-connected network that need to communicate with the Internet. So they're connected to the Internet only to get updates to fix bugs and vulnerabilities with their ability communicate on the Internet. Are they paying Joseph Heller's estate for this idea?
And what happens to bandwidth? Let's say it takes off and everybody has 20 to 50 NoT devices. So everybody within 30 miles of a cell tower has 20 to 50 devices that want to connect? Some those devices are almost certainly going to be excessively chatty or poorly implemented, given the quality of most software. What happens when Samsung and LG release the new firmware update for their newest line of microwaves, washing machines, and refrigerators? Suddenly 20% of all house holds are trying to download 2 GB of data over the air?
Like the other posters here, I'd like to see local-only devices that _don't_ connect to the Internet.
It's pretty hard to do this securely and easily, though: - We can't reliably get proper HTTPS certs for local devices (think e.g. a router admin page) - We can't reliably discover local services (I know about bonjour / mDNS, but it's flaky at best)
I think we as a community need to step up and provide a compelling open-source solution; the industry will follow. Look at what happened with 3D printers: Open-source moved first and established interoperable, open standards (g-code, STL files, filaments) and the industry had no choice but to follow, otherwise they'd be considered inferior. We need to do something similar with IoT.
Also I think LoRaWan networks wouldn't have to necessarily rely on the internet which is the original intent of the article. I think it could be possible to be much more localized like in your house, but right now its early stages and all of the tech i've seen is meant to provide much larger networks.