jaredraby · HackerTrans

vor 10 Jahrendiscuss

I no longer work at the company, but I used to work at a startup doing IoT devices. Our cloud server didn't stay up to date with security vunerabilities as we should have. Basically letting Mysql get behind in versions. There was also the issue of SSL being forgone in the name of time saving since I was the only one working on infrastructure. The development platform we were using broke on older versions with SSL enabled, so it was thrown into the wind before I had the time to deal with it.

This was due to being inexperienced with the work, too many duties, and a time line that didn't give me the time that I needed to fully understand some topics.

TLDR; -Security vulnerabilities from version updates -SSL on some platforms -Not having a dedicated / experienced individual on staff for dev ops in general

jaredraby

vor 10 Jahrendiscuss

It's not equal torque at all rpm.

jaredraby

vor 10 Jahrendiscuss

That's the case coming from my current job. Starting a new job on Monday. He had his fingers in everything, launched a product that was not ready for public release. Constantly micromanaged me out of using standard SE and EE practices despite my advisement against it and my push back. Suffered the consequences, manufacturers wary to sell because of all the problems with it. Can no longer support my employment because there have been no sales.

jaredraby

vor 10 Jahrendiscuss

I guess my opinion comes from the idea that there hasn't been a product or company that exemplifies a basic/robust system as we have both described. Everything has had the flashy app, or cloud connectivity, which in itself is a cost. If you're able to build a basic system completely contained, mark that up, you have just a regular hardware product, doesn't need to be IoT. Now, if you want remote monitoring, or backup systems you can start charging for that. Which, I might add, traditional security companies already do. And what many IoT companies seem to consider "essentials" rather than "extras". I think once the idea is shifted from user base / experience towards a goal to hit the actual benefits (ease of expansion / cheap data monitoring ) then we'll start to see IoT really explode.

jaredraby

vor 10 Jahrendiscuss

I agree that a robust system isn't hard. I don't agree that it's not profitable. If you don't make an app, that cuts down on your bottom line, not paying to make the app or the programmers to maintain it. From there you can just tack on additional services easily. Local storage for everything as they do now with security. Just give the users a micro SD card slot, say you can record everything right here. Charge them for a cloud connection / storage. Charge them for remote monitoring.

Agree with manual overrides there is no reason to not have a key. I'm surprised you've read about that because that's against regulation in commercial security. If power goes down there should be a battery backup to power it and keep the key card / door security working OR it turns off and you can't lock your doors. Better to keep unlocked than have someone burn alive inside.

The beauty of IoT is how it can be easily expanded and connected should you choose to. There is nothing preventing companies from implementing the same idea to the payment system. Charge enough for securing those IoT devices once they reach out into the world and I think you can have a real system on your hands.

jaredraby

vor 10 Jahrendiscuss

This was interesting look at home IoT is used in home security today and it's current downfalls. However, the items that seem IoT specific are ones that are issues in implementation, not application.

To frame what I mean when I say "IoT specific", I'm pointing out that many of the examples that he highlights are also the downfall of traditional security systems as well. If you have remote monitoring, and you internet/telephone line goes down, IoT or not, you've lost the service end of discussion.

  It doesn’t take a professional to realize his particular 
  house of cards is about as fragile as they come. It is built 
  on the assumption that one’s WiFi will always work, their 
  internet connection will always be up, power will always be 
  on, and every piece of software and firmware is stable and 
  trustworthy."

Power loss on traditional security, wifi loss on traditional security, hard wire cut on traditional security, all of these will take their toll as well, not just on an IoT system.

Onto the IoT specific related items. The implementation issues that he highlights; having to have your app open to record footage. Your cellphone being at the bottom of you bag and you can't reach it. These are all problems that can happen already. If you can't reach your phone when the security company calls you to notify of a break in, this is the same problem.

I understand why there is a lot of distaste for IoT, and all the security pitfalls that happen. However this is not an inherent issue to the concept, rather is a breakdown of implementation of security protocols that are not being followed and a lack of learning from traditional systems that isn't being applied.

After thinking about this for a while there are ways to bolster an IoT security or monitoring system: > Power / connection required for signaling. So rather than waiting for a system to signal something is wrong, wait for a heartbeat to die. > Battery back up: Pretty obvious. You should have a way to at least keep your systems for a period while you get power restored > Multiple links to a central service. WiFi and Cellular, monitor for connections going down and built in trouble shooting to notify the user if there is one or the other > Centralized data center for always on recording, pay an additional $10/mo for the ability to store your data elsewhere or offer local 24 hour recordings in the security base station in your home like many dash cams have now.

As for security concerns I look at it this way. Remote connections are something we've got down pat, assuming everyone follows it. Blaming IoT on being inherently insecure is like blaming the database password leaks on mysql rather than an open port and plain text user name / passwords.

I think IoT security has a place and purpose that offers benefits over a traditional system, we're just waiting for the right implementation.

jaredraby

vor 10 Jahrendiscuss

I love project and it's a great implementation of novel ideas all slapped into one package, but I do take some issues with how they describe it.

It might make it under a liberal definition of 'robot', but it certainly doesn't fit under what people think of as robots in a modern society. Also, it's just an oscillator in a novel implementation, not 'autonomous'. It's like saying my oscillating fan is autonomous.

Awesome progress, look forward to future development, but a little to hyped up for my tastes.

comments