Hacker News Reader

Comment by bblou | Hacker News Reader

I'm surprised you let your washing machine into your network. I now get the appeal of just an alert the washing machine is done. But I could not for the life of me allow any of these kinds of devices onto my home network. Even in isolation...

View on HN

Hey, blog author here. It only had access to the internet for a brief second, and even then it was on an entirely separate network because of how I just set up my openwrt router as a client to the main network. Our guest network is completely isolated, an explicit firewall rule had to be added so that my script could communicate with the washer while it's on this network. It has no access to anything but itself, and occasionally hears the screams of my script demanding it serves up data.

It has access to nothing, only my script has access to it - I don't see a risk here. I still have the heebie jeebies knowing it's connected to anything at all, or even the fact that it can do that, but also spending a night hacking a washing machine was incredibly funny to me and totally worth it. Plus, got some useful notifications out of it.

It's fairly simple to keep these devices isolated and if you have a decent firewall, you shouldn't have much to worry about. Keeping them in a separate, internet-only VLAN with peer to peer isolation is typically the standard protocol. That said, in a lot of cases, even keeping the isolated doesn't resolve any privacy concerns. Also, with some devices, you have to open up mDNS.

My dryer doesn't have a delay function accessable via the front panel, it's been "app gated", and the only way the app can talk to it is via WiFi, so if I ever need to set a delay, I have to use the app. All IoT devices are on their own VLAN though, and where possible firewalled off too. I can easily imagine more features being locked behind the app for future models.

I have all IoT devices in a VLAN, with a traffic rule that they can’t respond to any external requests unless they initiated it.

Good enough for me, but everyone’s level of comfort is different.

Why wouldn't you allow it in isolation?

How isolated are we talking? A device that only has access to the internet can still get botnetted and send malicious traffic from your IP. Or burn your data cap, or spy on you for the vendor.

But the comment said "I wouldn't allow it on my local network", not "I wouldn't allow it on the Internet".

LAN is being used in an under specified way. To my reading, a separate VLAN or standalone LAN for the washing machine wouldn’t be on “my (main/primary LAN is assumed here) local network” if I mean that “my local network” doesn’t have untrusted devices on it. I tend to read these kinds of comments with a bit of wiggle room because sometimes folks disagree about if VLANs are actually isolated enough to consider them separate local networks, as the same device may do routing and firewall or VLAN tagging, so there is isolation in principle, but bad actors can’t be expected to comply with network security policies.

I guess I can see how each of you could be right to their own reading.

I agree otherwise, but they said "even in isolation", which removes the ambiguity.

By they, do you mean that you said that?

They said it here:

https://news.ycombinator.com/item?id=44704593

But when you responded, am I bound by their context or yours? For clarity, I am responding to you both in a good faith steelman manner, so please respond in kind.

I thought the ambiguity remained, because different people have different opinions about network isolation, what it entails, how it may be implemented securely, and how different implementations have different implications regarding failure to maintain isolation in the event of a security breach that compromises networking equipment. Most folks aren’t running diodes at home. If your isolation relies upon configuration of reconfigurable equipment and/or VLANs, that isn’t isolated to readings that require or imply a highly secure computing environment.

https://en.wikipedia.org/wiki/Unidirectional_network

For untrusted IoT devices I’ve found that sticking them on the IoT VLAN (so no device-to-device communication, and either no or extremely limited internet access; but I let my trusted clients punch through to IoT devices) has allowed me to retain all functionality whilst being confident they’re not up to anything I don’t want or expect.

This is my setup. I find this to be a reasonable balance for comfortable life. Except my printer, that gets no Internet so it cannot update to some crappy firmware that nags about supplies.

Creating an IoT wifi that is one way is reasonably possible.

Someone shared this pdf written by someone that had a nice overview that is transferable to any router.

https://github.com/mjp66/Ubiquiti

For some folks the "just let it talk and see what it says" curiosity wins out

Why?

Reply on news.ycombinator.com