Hacker News Reader

Comment by WaitWaitWha | Hacker News Reader

Thanks for reaching out to the community.

Instead of mandatory updates, there are lower hanging fruits you can win, and will have just as much, if not more positive security impact.

1. No default password, one must be set at initial configuration

2. Devices must function without public internet connection (unless it is one of the device's primary function to transmit out)

3. Devices must function without centralized host

4. Explicit disclosure of all "phone home" destination hosts, and ability to change or disable this

5. Explicit disclosure what information is transmitted out, and ability to disable this

I think the above five can be implemented relatively easily, requires no continued maintenance from the manufacturers, and improves the CIA triad of IoTs.

View on HN

1. - routers have mainly solved this by having a unique, random password which is provided on a sticker on the device.

Other than that, these are really good.

I'd add something to address the problem of manufacturers going bust and then all their devices becoming paperweights. Perhaps:

6. it should be possible for the user to install their own firmware / updates. Optionally at the cost of losing guarantee and access to future manufacturer provided updates.

Routers are decently large , generally have enclosures, and are meant to be placed in a reasonably accesible position for those who should have access to them while at the same time out of sight for those unauthorized, which makes putting a sticker on it, keeping it there, and having the right people read it when needed is trivial.

Some IoT devices could be handled the same way, but there are plenty of reasonable IoT applications where a password written on the device is impractical or a security risk.

Sticker in the box / on the user manual could probably solve those cases. The problem with requiring a setup phase is that that means you're shipping it in a vulnerable state.

I recall Dell and HP servers at least used to come with a hang tag attached that listed the random initial firmware password. It doesn't need to be a permanent part of the device -- though you do risk losing the hang tag.

> unless it is one of the device's primary function to transmit out

I'd argue that even in that case it should still "function" without public internet connection, in the sense that everything but the egress transmission should be operable without public internet connection; e.g initial setup, later configuration changes, status, diagnostics, maintenance... Many devices use the "it's a transmission device by design" part as an excuse for "let's blanket require connection even for things that don't require it".

I have zigbee and wifi smart home based on Home Assistant, zigbee2mqtt and ESP Home. It is completely local, no internet required and works perfectly. The automation is done in Node Red. If I need to do some action from the internet, I do it through wireguard VPN (one click on my Android phone).

I especially like that zigbee is not even able to make connections to the internet itself. I "own" the devices.

I understand that VPNs are hard for average users, but centralised, potentially insecure server infrastructures, generally situated in China, pose a significant security concern.

By default, no telemetry. NO DATA OUT OF MY HOUSE WITHOUT EXPLICIT PERMISSION.

Out of curiosity, in what context has IoT telemetry been meaningful to the consumer? In other words, what data has been gathered that can be sold or otherwise abused? I personally don't see a reason to be concerned about a manufacturer wanting to track which features are being used and how those features are being used.

Yea, totally OK except they have to ask me first.

Telemetry has huge implications and it can be literally anything. Photos captured by a webcam can be “telemetry”, manf can always say we were verifying our image sensor calibration.

Reply on news.ycombinator.com