Hacker News Reader

Comment by Symmetry | Hacker News Reader

There's also the bit where Zigbee devices have to share a secret key to talk to each other, mostly to prevent competition from low cost devices manufactured in China.

View on HN

Yeah! They want you to use the high cost devices manufactured in China.

Or mostly the same cheap devices manufactured in China but sold through your friendly middlemen.

No, American Marketing Companies (Apple, Amazon, Google, Etc) want to use the Cheap China Manufacturers, they just dont want consumers to be able to buy them direct

When they kept the already known secret key for pairing bulbs in the new supposedly secret version of Zigbee it was obvious they didn't care about security at all

After all the "S" in IoT stands for Security.

I literally have an SSID on my Ubiquiti WAP with that as the name.

> mostly to prevent competition from low cost devices manufactured in China.

mostly to prevent competition from patent-infringing clones manufactured in China.

FIFY

I actually worked at Ember for a bit before leaving when they get bought by Silicon Labs. The reason, internally, really was the fear that there would be a flood of low quality products that would make ZigBee look bad.

as opposed to ZigBee making ZigBee look bad as it stands now. Only big names looking for a lockin pick ZigBee.

> fear that there would be a flood of low quality products

That's mental gymnastics. The fear is having to compete against cheaper products (possibly low quality, but possibly not). Even broken DRM is an excellent anti-competitive tool because no one can legally sell a competing product.

For that, you need certification, not gatekeeping.

Publish a set of tests a device must pass, broadly, to be certified compliant.

Allow manufacturers test their devices, for a fee, and win a certificate, or know where they failed. Much like you can take a language exam (say, TOEFL).

Key exchange for IoT devices is a tricky problem.

IoT devices don't support public key infrastructure, e.g. something like GnuPG or the SSL certificates used by web browsers.

It's a very practical solution to have a shared secret between the device and a central server, and, at registration time, have the central server make a key for both the hub and the device.

Without some kind of key exchange, people could set off your alarm, turn on your lights, open your door...

The solution is to have a pairing mode that allows the device to be paired with a control device (e.g. your phone) via wireless while you're in the same room as it. That would only have to be done once when it's installed and require pressing a physical button on the device while being in wireless range so that nobody can hack it remotely.

Out-of-band pairing is a better idea, e.g. some key on the bulb has to be entered or scanned or read on the device.

The trouble with that is that you can't change it in case e.g. some temporary visitor to your house snaps a picture of the key.

That shouldn't do them any good. The device should require it to be in pairing mode for the key to do anything.

But then what do you need the key for? In theory somebody else could try to pair with it while you have it in pairing mode, but they would have to be on your property for that and could potentially see the key anyway. So you go slap them with a trout or call the police or something, and then go back to setting up your future garbage.

So that that initial pairing is more secure.

Zigbee etc. tries to get around the whole thing by requiring that the pairing process is done from a 5cm or something distance.

Imho that is good enough but I don't know how far you could extend it with directional antennas etc.

That anyone can reclaim a device they hold in their hand is a feature.

If you as an individual has visitors who come to your house and snap pictures of codes in your devices... I wouldn't be more expectant of Zigbee or any other standards, rather I would be more keen on the visitors I allow into my house.

I'm not a fan. If I get a new hub, the last thing I want to do is unscrew every light switch to find the picture on it to scan and if I buy a house with pre-existing hardware I don't want to rely on the last owner having taken pictures associated with every switch and left it for me.

OOB pairing could have rolling keys, but that's more expensive. In general the problem is difficult, every solution has a nasty caveat, be it taking over during installation or what your described.

I will no longer install apps on my phone to pair devices. The reason is that then everyone wants to link my phone number to the device and create an account. There is nothing that intrinsically says they have to, but companies cannot resist asking for a unique identifier that happens to be linked to everything else in your life. No thank you.

So who says you should need their app? It should be a published protocol, and then you use whatever app you want that speaks the protocol instead of some heinous dreck from the manufacturer.

The part where they can't resist?

So no, there will not be a published protocol.

Isn't the topic of the article that they are trying to create a standard?

Isn't the topic about amazon, apple and google?

Probably most toxic companies on earth? Yeah, I'm sure it will be a wonder of openness.

Like ZWave has done for the last several years.

I know it has other issues, but particularly since ZWave2, the security model on ZWave far surpasses bluetooth or zigbee

If you look at the Zigbee member list, there are many China based companies. They don't need to 'steal' anything as members.

The comment mentioned nothing about stealing.

True. I was looking at TheKarateKid comment about infringing companies. The country where most stuff is manufactured, white labelled and sold at a premium by brand names :)

Reply on news.ycombinator.com