Hacker News Reader

Comment by WD-42 | Hacker News Reader

Maybe encryption isn't important for you, but it is for some people, especially professional athletes. Imagine a Tour De France rider or their follow car being able to read the heart rate of their competitor - this could easily inform their strategy.

View on HN

We're really going to screw things up for everyone else because of a couple dozen professional bike racers? This deal sucks

Are we really going to argue in 2025 that encryption is too hard?

We are really going to argue in 2025 that encryption is too hard when you want a cheap, tiny sensor to operate for months on a single CR2032 battery.

I'd want to see actual numbers.

Radio transmit is expensive power-wise. The numbers I'm seeing for BLE energy per bit are all over the place, but the numbers I found for some SHA3 testing say that even with a pretty old chip fab you can make a circuit that encrypts more than 10 bytes per nanojoule. That's a pretty small tax.

So like my wireless shifters whose battery I haven’t changed in over a year.

Wireless shifters only transmit when you press a button. Power consumption is higher with other sensors that transmit continuously at 1Hz: heart rate, running foot pods, wheel speed, cadence, etc.

Exactly. Transmitting over radio continuously is what is expensive, not encrypting a couple of bytes.

> tiny sensor to operate for months on a single CR2032 battery.

Not to mention real-time broadcasting of sensor data to multiple devices.

In the case of HR data: ~1 update per second which is usually broadcasted three times in succession to ensure transmission)

Good handshakes are actually hard. There's no UI on these gadgets, and often not even a single button! Consider going to a public gym and wanting your heartrate to show on the exercise bike -- you'll be pairing it right there, in public.

Reducing the risk to handshake is already pretty good, but also that's going to be quite hard to MitM. Just use diffie-hellman.

If this scenario is relevant for anyone, it's a tiny number of people. That leaves 99.99% of the fitness market.

If they care about that kind of privacy why would they not buy a device that has encryption for the broadcasting?

Imagine a Tour de France team who spends millions of dollars being unwilling to find a company to build them a custom monitor that supports heart rate monitoring with an encrypted data stream if they can’t find one off the shelf.

30 seconds of searching shows me the polar h10 is already multiprotocol and supports Bluetooth.

https://www.polar.com/us-en/sensors/h10-heart-rate-sensor/

The Polar H10 broadcasts your heart rate unencrypted in ADV_IND frames last time I checked.

It seems that pro cycling teams aren't actually very concerned about this.

https://www.facebook.com/dcrainmaker/posts/pfbid02doLyLhNSwT...

It's health and presence info. In surveillance capitalism your or your flat neighbour's devices might capture it, upload to cloud and sell it, the buyer of the info might combine it with location data etc to bind it to your identity, and sell it onwards.

The next time you buy health insurance or are involved in a court case the data may be used against your interests. (probably someone can invent a still more nefarious scenario)

Reply on news.ycombinator.com