Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

The reason I can say my smarthome is relatively secure is explicitly because it doesn't use IP. It's good they're trying to standardize, but you're gonna have a problem when you try to use a firewall to inspect what these devices are up to and find that they're all making encrypted tunnels back to their home bases and won't work without them.

View on HN

I've been gradually retiring my wifi smart devices in favor of Z-wave because I find them far more reliable and much easier to maintain and manage.

It's also a little annoying having a pile of wifi devices whose only purpose is to manage an on-off state consume IP addresses on my network.

I share your need to name all my devices in the controller view. Hopefully zwave has better security support than typical IoT devices. I'd really prefer to use certificates rather than WPA passwords because password rotation requires a) I give vendors my passwords which they may not really secure in any way, b) often requires I use a vendor tool to rotate said password.

It would be much preferable to have a standard way to store a certificate to the device. Today when the inevitable happens and someone leaves customer WPA passwords on an open S3 bucket, or they're exposed via cyber security break I have to update every device. It would be so much nicer to just go update my compromised device's certificate rather than the password for everything. Frankly I'd prefer certificates to passwords anyway because sooner or later I'm sure WEP2 itself will be broken.

This is false sense of security. Industrial SCADA and CAN networks have been found full of vulnerabilities because people assumed they were magically secure by simply not using IP.

You can easily isolate an IP network and inspect its traffic.

You cannot easily inspect less common protocols.

Obscurity and lack of tools never helps security.

The reason I can say my smarthome is relatively secure is because I don't allow any of the devices to access the internet. IP or not seems irrelevant.

The high level of sophistication of IP networking and the fact that one small mistake could mean your devices access the Internet is why a network that doesn't talk IP is almost inherently safer than one that does.

There is a great point here you haven’t made yet.

It may seem trivial for those of us on HN to block IP devices from the internet, but the average user will not know how to do that effectively. They are also the ones who’s devices probably remain on a botnet undetected by their owners.

That said, most hubs (required for these types of devices) connect to the internet by default anyway. It does reduce risk a bit as vulnerability in a node isn’t exploitable remotely.

There's no sophistication: just plug a Wifi router to an outlet but not to the Internet cable.

I think any home automation system should not have to rely on the home owner having a CCNA cert in order to be secure.

Buying a Wifi router and not plugging it to the Internet doesn't require a CCNA cert.

Yes, it's an extra device, but so is the Zigbee hub.

Most people are not going to buy a dedicated WiFi AP just for their home automation.

The benefit of Zigbee, even when using a hub, is that you don’t have all the actual devices on your network, calling home, and possibly opening up NAT traversal streams. You just need to worry about the hub. With WiFi devices, you need to worry about all of that for all of them.

Reply on news.ycombinator.com