Hacker News Reader

Comment by syntaxing | Hacker News Reader

I get uncomfortable how this is probably true with all these smart TVs as well (especially the budget TVs). I set up piHole to try to prevent this but nothing stops it from phoning home via a direct IP. It sucks because all our electronics get poisoned since good brands get squashed out by these low cost alternatives that consumers love at the expense of privacy that no one cares about anymore. Also, another crazy thing is ISP provided routers. I was unable to change the DNS on my modem/router, let alone change the security settings.

View on HN

The fix for this is to just never ever connect your TV to the internet. Devices like the chromecast and game consoles generally have better app support and usability than most smart tvs anyway.

It doesn't make sense to tie the lifespan of a display to the lifespan of software support when the computing hardware is so ubiquitous outside of the TV anyway.

This won't stop Whispernet-style LTE communications.

True but they won’t have lateral access to your local network nor would you be entering credentials to online services.

I would be surprised if consumer home electronics like this would be shipped with anything other than bluetooth/wifi radios.

While the advertising / data sharing revenue is valuable to them, the vast majority of those are going into homes where they're going to be internet connected already. The cost of a modem + service fees for it wouldn't be worth it for most of them.

Amazon is starting to ship their Sidewalk protocol[1] which will be embedded into a bunch of their devices - but that seems to be mainly for low-power/remote devices to connect back to a Sidewalk access point, rather than to provide an alternative data-path for (say) customer metrics.

[1] https://www.amazon.com/Amazon-Sidewalk/

One of the driving forces is for every device to have a 5G connection, no wifi needed. Everything will have an IPv6 address soon.

I do not agree with any of that, though.

I'm thinking about it from a BOM cost, though.

Consider the beancounters at the manufacturer:

We are shipping a SmartTV, we expect our users to therefore have internet access, because the device is mostly non-working without it.

Why would we then include: a cellular radio AND make us pay for a cellular data service on an ongoing basis? Is the data from some small fraction of users who don't already have wifi valuable enough to pay off the hardware and service costs in every other TV? Seems unlikely.

I bought the very first Kindle and it came with free Sprint cellular data service.

Look at how much an ESP32 can do and what it costs.

At scale, the cost of the additional electronics is negligible, especially if it is being subsidized.

Nobody is making you pay for service. It will simply send back fingerprints of your screen image and usage data, and can probably load ads, as well.

Kindles with Whispersync over 2G was subsidised directly by you buying books.

You'll note though that getting a Kindle with 3G nowdays means paying for the more expensive models - Paperwhite or Oasis.

> Nobody is making you pay for service

I think you missed what I said. I was talking from the perspective of a manufacturer.

The cost of buying and integration the new hardware, and also an ongoing monthly sim cost for the benefit of getting analytics and ads from a tiny fraction of your userbase that does NOT already have their TV hooked up to wifi is significant, and I doubt it comes close to the added revenue you might get from that fraction of users.

That also assumes that those who don't have their Smart TV hooked up to wifi are going to be in cellular range.

LTE-M1 chips are getting closer to that region. Besides, cars have had it for decades, under “telematics” terminology. Intention is Google Analytics for physical cars, but they OTA, connects to internal CAN bus, technologically not infeasible to cause unintended accelerated drive into walls if taken, and it’s completely on the house, free of any payment.

You'd only have to pay for cellular data service for devices that don't connect to WiFi. So the only real cost is whatever the modem costs.

I think what'll really happen is they'll become always online devices where if you're offline for more than X days they quit working and claim they need an update - please connect to the internet.

The same users who would sue you if you took their data. Its just not worth it when 99 percent of the population welcomes the smart TV craze.

I used to rant about these ipv6 privacy concerns back in 2010. Nobody believed me. https://news.ycombinator.com/item?id=1742431

If a cellular network IoT is the future, why is it blocked by 5G deployment? Seems like it could just happen now with 4G. Does 5G relax the need for a phone number (which I believe all 4G devices have, even if they can't make calls) or something?

The problem with the "5G" terminology is that it groups a bunch of things together, in a meaningless blob of vague hype.

Some of the technologies are specifically intended to give "phone home" connectivity to low-power devices: https://en.wikipedia.org/wiki/Narrowband_IoT https://en.wikipedia.org/wiki/LTE-M

Wouldn't just identifying the chips and drilling through them be more effective?

Or don't reward spyware makers by purchasing appliances that can phone home.

Bonus: This way, you don't have to worry about open wifi networks.

>Bonus: This way, you don't have to worry about open wifi networks.

I live near a BK, my TV could dl some auto auth for the wifi and just upload my habits... if it wasn't specifically chosen to reduce that probability.

> my TV could dl some auto auth for the wifi

How is it possible that your TV could automatically log into your wifi?

I believe they’re suggesting there is a public WiFi network in range of their home.

Where I live I can see a few dozen networks active. At any one time at least a few are public.

When purchasing a TV, this is getting more and more difficult. There’s few dumb displays out there these days.

I recently bought a TV and couldn’t find any dumb ones in the local big brand stores.

They exist, but not at the big stores. You need to find one targeted at a conference room, or factory. The factory is probably better because safety information is displayed on them so people can die if it doesn't work for some reason.

Why would you connect a Chromecast to the internet but not your TV? They're equally as bad, as they both collect your data/viewing habits to sell to other people, same with Roku.

Don't connect your TV to the internet, buy an Apple TV.

Luckily the out stickers at the store to tell you which ones collect data.

Or use an open source system like Kodi.

I trust Google’s security more than an OEM focusing on cost minimalisation.

Giving google my viewing habits is bad, but giving Hisense + DodgyAdBroker.biz + CCP/PLA is even worse.

I'm not sure how buying a device connected to the internet, fully controlled by the company, that also collects data and sell ads is an improvement.

> The fix for this is to just never ever connect your TV to the internet.

My understanding is that lots of them aggressively sniff and try to hop on any unsecured network that they can find.

TV's and smart speakers connect to any open network. Alexa connected to my neighbour's wifi network.

Alexa connected to my neighbour's wifi network.

Is that legal where you are, assuming your neighbour has not granted permission to do it?

I don't know . But I've unplugged the Alexa Echo and put it inside my cupboard long ago.

Depends, and either way you’re being held responsible for the manufacturer’s decision.

In the US I'm pretty sure it's legal at the federal level because the network is actively advertising itself by broadcasting the SSID and no user name or password is required when connecting.

AFAIK, violating the CFAA would involve actively circumventing a mechanism intended to restrict access.

The only way to stop wifi on my Samsung TV was to plug in ethernet and block all traffic from it on my firewall. Extremely annoying that there is no setting to disable it.

That's not a fix.

This is a field that cries out "decent regulation". Terrible IoT security? Please see massive fines, Senators on TV claiming national security at risk, never allow that brand to be sold "on our soil" again.

I know there is no obvious technical framework that can be applied as " best practise", that IoT is a horrible wild west and governments choosing winners will lead down sub optimal paths but it's hard to see a real alternative fix.

Maybe the potential regulators are also enjoying the free surveillance infrastructure

This is an extremely difficult problem. The proximate problem is that there isn't liability for industry when there should be. The proximate fix is adding liability into the equation one way or another. Using regulation may work, it theoretically ought to but Regulators tend to get captured by industry. Another way is to open the issue up to civil liability/class action lawsuits which requires a cooperating political and legal class who also tend to get captured by industry. The only way to overcome that is for the population to make it politically untenable to kowtow to industry. However, the population isn't educated on this and the political class which controls education for most people is unlikely going to push for it. Even if they were educated because the costs are diffuse and the interests are concentrated the population is unlikely going to feel the urgency to make this a political priority and the special interests certainly won't. Politically speaking the priorities of the Hacker News crowd amounts to very little. I would love to hear ideas about how to overcome these problems.

The EU which is a bit more pro regulating stuff is having a go eg:

>The European Telecommunications Standards Institute (ETSI) has released what it calls a globally applicable standard for cybersecurity in the Internet of Things (IoT). The new specification, TS 103645, seeks to establish a security baseline for internet-connected consumer products and provide a basis for future IoT certification schemes. https://futureiot.tech/europe-gets-first-global-consumer-iot...

Maybe if that works other places will follow.

I agree - I meant fix in the "here's how to selfishly make this work for you" sense, rather than the "actually fix this for everyone long term" sense.

Ok. English double meanings - great for jokes bad for comms!

> The fix for this is to just never ever connect your TV to the internet.

This conversation happens on HN every week, and each time, commenters point out the numerous flaws in this plan:

Manufacturer requiring a firmware update or internet connection for the TV to work, quietly connecting to internet over HDMI, connecting automatically to neighbour's unsecured wifi, shipping with an internal cell modem, and many other methods that might be around the corner as privacy norms drift and certain technologies become cheaper.

The one I worry about is 5G. p2p to a nearby 5G device that gets you out.

Add IPV6 to this scenario and it allows for incredibly fine-grained device identification and possibly/probably location. I can really imagine data-gatherers/advertisers going crazy for that.

Or don't have a TV.

I dislike a lot of "smart" devices, but off-brand or no-brand IoT and "smart" things are a hard no. I assume these to basically be spies or malware vectors. Even if they're not deliberately malicious I figure there's a good chance they are insecure as hell.

I tend to go with US-based companies because they would legally be liable for damages, which would in theory mean they'd be less likely to knowingly ship malware and security disasters.

Even then, IoT devices are going on their own 'guest' network that none of my own devices are on.

That's a good idea but it still doesn't protect you from spying. And you'd have to put each device on a different network to prevent them from infecting eachother. That probably also has the side effect of making them basically useless. How do you segregate your smart speaker and your smart lightbulb and your smart TV and still control them from your cell phone?

I think you missed something there -

Either your devices and hub don't need to be exposed to the net (so why are you even using a router connected to the web?), or they do.

If they do, it's because that's how you control them, via the web. If that's the case, it doesn't matter what network your phone is on; command and control is done via the web.

Now, in terms of infecting each other, sure. But the point is to keep my data devices and such separate from my IoT devices. Yes, the whole IoT infrastructure may get infected and need a purge, but my goal is to keep infection of those from getting, say, my banking information. And yes, it assumes that the command and control app is reasonably secure, but that's a whole different issue (and one reason why I would rely on Amazon or Alexa as a hub, and not some random no name company).

Sure, this is why I have almost no IoT things. The only thing I can think of is my scale.

I'm curious if you have suggestions for a hackable home automation/IoT hub that I can use without giving it access to the internet. I'm happy to DIY anything that doesn't deal with mains voltage.

A friend pointed me to Home Assistant[0] after I said I was going to look into Hubitat[1].

[0]: https://www.home-assistant.io/ [1]: https://hubitat.com/

There's also Homebridge/HOOBS, if you want to link 3rd-party IoT devices to Apple Homekit. Many of the plugins run locally.

Homebridge: https://homebridge.io HOOBS: https://hoobs.org

I have plently of home automation, none of it is controlled with my cell phone. IMO That defeats the purpose of AUTOMATION

it should be automated, you have controls in the house that trigger actions, ie a door opens, or a light switch is triggers.

If I have to use my phone to control it, I have failed at automation

For true automation sure but I can think of "IoT" applications where using the phone would be nice. Lighting most of all.

I have a small arcade in my basement and the ability to control the lights from my phone would be way better than using the wall switch, mostly because of outlet placement and the fact the switch has to stay on.

My living room only has one switched outlet and it is the one closest to the switch. The lights across the room have to be manually controlled.

I've done some research into wifi controlled outlets and I have some very old radio controlled ones but I need more. Do you have any suggestions for hackable wifi plugs that do not connect to the internet? Maybe something that connects to a hub?

My dream would be something where I can make my own sensors and talk over wifi to outlets that are UL listed, without involving the internet. I'm happy to DIY anything that doesn't interact with mains voltage.

Most of my home automation is Zigbee or Zwave not WiFi, Outlets for the most part are SYLVANIA SMART+

Zigbee/Zwave is controlled via Nortek USB interface connected to a rPI

Though I do have a couple of Shelly Devices, and some custom ESP8266 things

Thanks, I’ll check that out.

With Black Friday/Cyber Monday coming up I’m trying to compile a shopping list of good gear.

>>I tend to go with US-based companies because they would legally be liable for damages

I am not sure under what legal basis you draw this conclusion given the EULA's and other laws explicitly shield them from said liability

you would have to prove intentional malicious intent not simply negligence

One of the big problems I have with more US Companies is they are a network of vendor Lock-in proprietary ecosystems that often do not work well together at all.

I prefer Open protocols, which sadly seem to be only adopted by non-US Companies.

What gateway is the TV using? You can put your own router in front of the ISP one, and set your computers including your TV to use your router as the gateway, not the ISP one. Relying 100% on a third party router (where you do not control the OS) is similar relying 100% on a third party DNS provider (many PiHoles are set up to use third party DNS providers). This is willingly delegating 100% control to a third party. Some of that control can be retained if desired by using own router (with OS you can fully control), or in the case of DNS by using own DNS that you can fully control.

I had to put a router in between. So the setup is piHole -> Secondary Router with PiHole as router-wide DNS --> ISP router/modem. I'm kind of tempted to just straight up buy my own modem.

If the ISP charges you a monthly fee for the modem/router (you are "leasing" the modem), and you have been a long-term customer, you may have already paid the full price of the modem; yet you do not own it.

Let's say the customer connects their own Wifi router to the ISP modem/router via Ethernet cable. There is no need for the ISP modem/router's Wifi AP. Does the ISP modem/router allow the customer to disable it?

Don’t connect you TV to the network, use a computer or Apple TV instead.

> I set up piHole to try to prevent this but nothing stops it from phoning home via a direct IP.

what exactly do you mean? I tought piHole sits "between" the tv and your modem? I mean it probably can easily firewall those ips.

Edit: nvm PiHole is only a dns thingy.

PiHole is for DNS blocking.

So if say your TV calls out to backdoor.example.com - then PiHole can block it.

If instead it calls out to 1.2.3.4 (i.e no DNS lookup) - then PiHole won't block it for you, you'd have to instead set up controls on the firewall/router/etc to filter traffic.

Just wait till all the smart devices come with a preloaded DoT/DoH list.

That would be this thread - https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2R... and this post https://news.ycombinator.com/item?id=19170671

recycling my comment from Mozilla DoH story:

Wanted: Firewall blocking all traffic directed at IP addresses not obtained from OS DNS resolver.

aka dynamic application level FQDN Egress Filtering. Mayor Cloud providers (aws, azure) and bigger firewalls (fortinet, cisco, paloalto) already offer ~half of what I want.

I want a little deamon that listens for DNS queries/replies and modifies firewall rules accordingly.

Also, the other risk is the device not respecting what your router says to use for the DNS server.

So, it could still bypass piHole and still resolve hostnames.

This is more crazy. Is this achieved by hardcoding the DNS server IP address in the device?

More likely the destination IP address is hard coded, so no name resolution is ever required.

Chromecast devices (some? all?) have Google's public DNS servers hard coded. Paul Vixie wrote a nice rant about catching these devices trying to bypass his local DNS servers.

All Chrome based browsers have 8.8.8.8 8.8.4.4 hardcoded under the guise of "helping resolve navigation errors", except its not helping anyone but Google in gathering statistics. Domains like hls.ttvnw.net (no A record) receive perfectly valid DNS reply (NOERROR, response code 0, DNS Query completed successfully) but trigger this feature and call hardcoded Google DNS resolver. Even domains that dont exist at all and browser receives valid response (NXDOMAIN, response code 3, Domain name does not exist) trigger to snitch on the user to hardcoded Google DNS resolver. No errors, google called.

There was a version of Awair devices that used 8.8.8.8 for DNS, no matter my pihole.

At the router level, I then forced all 8.8.8.8 traffic to be transformed into traffic to my pihole.

You can do the next step, but you need a router that supports it and the patience to handle it.

You shouldn’t need to do this.

I force all outgoing traffic to 53 not Pi-Hole IPs (I run redundant) to go to a Pi-Hole instead. Initially I did tgat for Chromecast. However, I doubt Chromecast still cares. Why do you think Google push Do{H,T}?

Well, it is also possible to not use port 53 as UDP to resolve DNS.

So, if it is using HTTPS for DNS resolution, I don’t know how you would block that.

If you could install a self-signed cert onto the device, you could MitM the HTTPS traffic and see what it is doing.

> if it is using HTTPS for DNS resolution, I don’t know how you would block that

By filtering traffic sent from that particular device based on a query to your DNS filter to approve or deny the destination address. (Some implementation work probably required.)

This is also true for almost all of devices which could connect to internet. We need a portable small router with firewall feature which could physically ban the specific IPs or domains.

For example, iOS to Apple, mac to Apple, Win10 to MS, etc. These connections are much difficult to ban nowadays. What we could do might be limiting their upstream connection via physical firewall router with built-in good web-based GUI.

I hate the ISP router thing.

AT&T pushed an update that added an "Application Statistics" page to the router which keeps track of ports and sites visited and is basically hostile to privacy.

thing is - this is a rented router, so what can the customer do?

Also every time they push an update wifi turns itself back on. So I go in and disable it and then I get a giant warning email "AT&T wifi gateway settings updated".

That is precisely the reason why I want ( or I once want ) Apple to make an TV set and not a TV Box. Their Brand, software and UX could create enough value for consumer to buy and set the standard for TV industry.

Or someone to create a standard where the Panel is now working more like a Monitor and All electronics are into a separate box.

It’s called an Apple TV. You can buy any TV just don’t connect the TV to the internet.

Seriously, I wish TVs stuck to being a dumb display with a modular computer that you can swap or simply pull out if you don't trust it.

I think there's a way with the more advanced routers to intercept all outgoing DNS queries and redirect them.

That still doesn't help with direct IP communication. You'd have to block all traffic except services you want to interact with. That probably means never getting a firmware update or at least uploading some telemetry when you allow a connection back to the mothership for a firmware update.

There's no winning with IoT.

> There's no winning with IoT.

There's no winning when a third party controls the lowest-level software of a thing on the internet. That includes your general purpose computers.

Unless you are the owner of the signing keys down to the bottom of the stack, your system can be remote-controlled.

It's called a network tap, or port mirroring.

Not with DOH

Why not just leave them disconnected and use brand name TV streaming boxes instead?

You can just keep a smart tv off the internet, no?

By a stand-alone Roku for apps?

Roku also sells your data, same with Google and likely Amazon.

Apple TV is what you want if you don’t want to have your data/viewing habits sold to outside companies.

... and then to exclusively watch things bought rented from the i/Tunes/Apple Store?

YouTube or Netflix or whatever can still do whatever they want with your 'viewing habits'.

Roku's are no better.

The top device on my network being blocked from reaching it's mothership are my Roku devices. This is the top analytics from my NextDNS console for the past two weeks:

scribe.logs.roku.com 417,115

stats.gc.apple.com 24,752

ssl.google-analytics.com 16,178

track.sr.roku.com 7,534

Roku is easily on the top of my list on spying devices on my network. The Apple ones, while still worrying, are on a network with tons of Apple devices between phones, MacBooks, watches, iPads, etc whereas there are three Roku's making all that traffic.

Yes, TCL TVs are largely venerable.

*vulnerable

Reply on news.ycombinator.com