Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Since network end points have supported HTTP GET requests.

If your router or IoT device isn’t secure any webpage online can embed a (for example)

  <img src=“http://192.168.1.1/enable_remote_access.php”>
And it’s not as if consumer routers nor cheap Chinese IoT hardware have a proven track record for security.


My house has some windows. Acording to google i shall buy a house without windows so neighbours do not look inside my house instead of using courtains or window blinds.


That’s a weirdly good example actually, because if you have a window you want hidden then the average user understands that they can install curtains or blinds. But if stronger countermeasures are required for security (eg the window needs a physical alarm) then you might get a professional in to wire that alarm up. Curtains nor blinds are not going to stop someone from breaking in but the average person knows this.

With home networked devices the average user doesn’t know how to hide and protect those devices so here again they need professionals to do that for them too.

Windows weren’t intended to be entry points for burglaries. It just so happens that some Windows, particularly in older houses, aren’t all that secure so need additional countermeasures. Like wise for some home networking hardware.


How would an app that would probe someone's house for open windows "Your windows are not secure!" go down? I imagine these exist but not widely known. Virus protection sufficiently got in the psyche of computer users... does Windows do this scan on a local network?

Lots of questions as I genuinely don't know, I just turn lights on and off through switch devices mounted on walls.


Great, stop using this crap.


Easy for you to say but harder to explain to the average layman. How do they know what is and isn’t a secure IoT bulb or router? In fact in the case of an ISP router, how do they even know how to replace a router even if they did know their router was garbage?


You parent poster is ranting in more places in this thread, with complete disregard for the fact that most people aren't professionals in the IT space.

The answer is obvious, they don't know, just like I'm not very good at particle physics or repairing broken body parts.


> harder to explain to the average layman

Fairly easy: anything that's labeled "smart" or "remote control from your phone" is wrong and bad for us. We IT people should be explaining to "average laypeople" that they should never trust the industry, instead of climbing aboard the IoT bandwagon.

I had many discussions with half a dozen neighbors about Alexa after i learned that some people actually have this bundled with their ISP here in France. After i explained how it works, not a single one of them kept it.


It’s not that easy in practice because

1. It’s not just smart devices that are a risk. Eg some ISP routers are insecure.

2. Smart devices aren’t always so easy to spot. An IoT light bulb is pretty obvious. But what about a TV? These days it’s almost impossible to buy dumb TVs and most computer monitors don’t have speakers built in. So in some instances it takes extra effort to avoid smart devices.

3. Some people actually like the convenience of smart devices. I have some IoT bulbs at the bottom of my garden and they were actually the best solution to the problem I had (which I won’t bore you with here but the other options like solar lights weren’t suitable). What if someone wants to watch Netflix or Disney+, should they be denied that because they are told to avoid anything “smart”?

Saying “we shouldn’t have nice things” isn’t a good enough answer to the “how do we secure bad things” argument. It’s throwing the baby out with the bath water. And even if I agreed with you, “smart” is already in our lives, there is no way to put that genie back in the bottle even if we wanted too.


Especially in the case of ISP cable modems.


I can only afford crap.

I show this crap to my friends who are jealous.

They buy this crap, then forget to install the aftermarket firmware I spend hours of my time installing so that it's a lot safer than it was.

How do I get them through the second step when half of the "normies" I know can barely pair their phone with their car without reading the manual?


> I can only afford crap.

"Crap" to me would be low-tech non-smart light bulbs.

That's what I buy. IMO, "smart" bulbs are dumb and unnecessary. The only time I ever need to turn a light on or off is when I'm entering or leaving a room, in which case I'm passing the light switch anyways. I have no need to be able to turn my lights on and off from my phone, and don't understand the use case.


> pair their phone with their car

Please don't. Just like with the rest of "smart" and "IoT", "just don't" is the correct answer in terms of privacy, security, and other basic human rights.

Just use a jack cable for audio "pairing" and an actual button for turning on/off lights, and a key for opening your door. It's as simple as this: really ecological, secure and user-friendly.


Bluetooth in cars is useful, especially since it allows the car’s built-in ergonomic media controls to affect your phone. Being able to take a call or pause your music without looking anywhere or moving your hands away from the wheel is a safety improvement.


I understand this UX argument: there's however arguments against it as well. For example, "taking a call" (at all) while driving could be illegal in your jurisdiction, and is in any case a safety risk.

The computerization of the car has other negative consequences:

- cars are increasingly more expensive due to electronics (which represent up to 50% of the price of a car nowadays), and are victims of chip shortage

- cars are much harder to repair and require cracked firmware downloaded from sketchy websites or an official and super-expensive maintenance kit, which of course only works for one brand/manufacturer

- cars are much less reliable and electronics are responsible for a great number of recalled products

I miss my old autoradio with a jack input. Overall, i miss when my car was not a computer: we computer people can barely display a few pixels on a screen without writing a dozen bugs, why the hell would we responsible for making software for cars?! see also boeing scandals.

So while bluetooth is a safety improvement over the worst-case of using a mechanical car and a phone at the same time, it's part of a trend that overwhelmingly makes cars less safe and reliable.


Bluetooth is entirely unrelated to other computers in cars. In fact, it's just the car's "radio" component that speaks bluetooth. You can easily install such a component in 70 year old cars. You'd only lack the ergonomic steering wheel controls, which are generally connected to the "radio" directly.

Other car functions use computers for very different reasons. The most successful is injection timing, which does significantly improve performance. It's why we have extremely efficient small diesel engines and reasonably powerful 1L petrol engines.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: