Some ramblings on HTTPS and IoT - Page 1
Forum section: electronics / general

author: msr
author_rank: Regular Contributor
timestamp: March 17, 2017, 07:28:06 pm
content: Hey everyone,Now that HTTPS is becoming mainstream, I would like to ask you: how the "IoT" can cope with it?Let me explain. As you know the idea of IoT is having zillions of sensors spreaded along the globe, most of them are likely to be very low power and use very limited hardware which can't run SSL. So, no HTTPs capability. Right?I'm thinking about this because I recently got a project where I were required to send some data to an API. I picked up an Arduino Leonardo Ethernet totally ignoring the fact that the API was running on a HTTPS server. That board uses the WizNET chip (W5500) and there's no way SSL can fit in a system like this. My next bet, and because I need to get this working as soon as possible, is to use a Raspberry Pi. Low power is not a requirement for this project. But what if that was the case?Do we really need a full fleged computer everytime we want to send some (IoT) data to the cloud?Also, I don't feel confortable using a RPI 3 on a new product (availability/suppy chain/NDAs issues)Any thoughs on this are greatly appreciated

author: coppice
author_rank: Super Contributor
timestamp: March 17, 2017, 07:42:19 pm
content: Most current IoT platforms are dead ends. No capacity for SSL. No capacity for IPv6. Very limited ability to deal with updates.

author: Dumont
author_rank: Newbie
timestamp: March 17, 2017, 08:08:10 pm
content: Systems will have limited capacity, but they'll need to be sized in order to provide enough oomph to meet a security requirement. However that requirement won't be met with TLS and traditional RSA style public-key encryption. There's already a move to focusing on datagram based protocols and adapting tools to work that way. This reduces processing overhead to perform the security tasks, and also allows for much lower power consumption.For example using Datagram TLS (DTLS) instead of traditional TLS. Also, a move to cryptographic systems that can be implemented securely with a lower resource overhead as well through things like Elliptic Curve Cryptography and hardware acceleration to assist that.As an intermediate step it certainly makes sense in some cases to centralize the processing power locally to something like a gateway node that can have more resources to secure data that might be fine locally before putting it into the wilds of the Internet/cloud.

author: mhwlng
author_rank: Contributor
timestamp: March 17, 2017, 08:31:51 pm
content: The ESP8266 arduino 'WiFiClientSecure' libraries have SSL/TLS built in :Code:WiFiClientSecure client;client.connect(host, 443)sourcehttps://github.com/esp8266/Arduino/blob/master/libraries/ESP8266WiFi/src/WiFiClientSecure.cpp

author: Red Squirrel
author_rank: Super Contributor
timestamp: March 19, 2017, 12:43:26 am
content: The main issue with IoT is that it should not even be on the internet in first place. It should all be based on a local network and have a central local controller server. If you want remote access then you setup a proper VPN.Though guess I'm a bit old school too, all my automation/sensor stuff is wired. The central server actually powers all the sensors. My software would allow to have wireless nodes too, then it would use normal wifi which is already encrypted. (don't know how good it is, ex: if NSA can crack it, but it's there)

author: Ampera
author_rank: Super Contributor
timestamp: March 19, 2017, 12:51:47 am
content: Quote from: Red Squirrel on March 19, 2017, 12:43:26 amI totally agree with you almost on every point.People don't need a goddamned fridge that can tell them when the ice is running low, or when the milk is out. We have spent millions of years through thousands of distinct species in order to develop highly accurate, and incredibly useful EYES that can do the SAME exact work for NO money at all.How about the Smart TVs? Because HTPCs and Chromecasts are so hard to use. I mean common.The story is the same with cable boxes. I mean can't you just throw together a QAM decoder and be done with it? In the US of A we don't have DVB anything. Our only digital broadcasting system for video is ATSC which is TOTALLY useless unless your in some strange place that actually has any channels. I get 3-5 in my house off ATSC. We also don't have consumer non-subscription satellite TV like DVB-S in Europe.I think IoT should die in a hole. It's another piece of shit on the list of crap that nobody asked for, and is only shiny keys jingling infront of incredibly dumb babies on the market.

author: nctnico
author_rank: Super Contributor
timestamp: March 19, 2017, 02:10:24 am
content: Quote from: Red Squirrel on March 19, 2017, 12:43:26 amThe problem with that is that you'll always need to have the extra box which doesn't add value. Besides that a lot of people already have a box between internet and their local network: a router.

author: Neganur
author_rank: Unknown
timestamp: March 19, 2017, 08:26:09 am
content: Quote from: TwoOfFive on March 19, 2017, 12:51:47 amI used to have a similar opinion about a tweeting toilet....until a friend of mine said Oh My God! We can finally do medical statistics on elderly people's 'affairs' and check that they are healthy.I blinked in disbelief, because why on earth would that be important information, but apparently for some people it is really useful.It costs money to send people around and check fridge content. This way it is known ahead of time what is still in the fridge and it can be ordered and brought with the care service.And I do agree that I personally do not need an IoT fridge and would never have sought to develop one either.There is this thing called translational engineering:http://studyguides.aalto.fi/elec/2015-aee/majors/translational-engineering.htmland I can totally see now why some of the weird stuff we shake our heads at can be useful in other ways.

author: ebclr
author_rank: Super Contributor
timestamp: March 19, 2017, 08:53:39 am
content: Very high probability of finishing herehttp://mqtt.org/

author: Galenbo
author_rank: Super Contributor
timestamp: March 28, 2017, 09:28:07 pm
content: Quote from: TwoOfFive on March 19, 2017, 12:51:47 amNo, but the goverment, and their globalist/corporatist friend, do.They want to know when and how you are at home, and control your behavour to compensate for their shortcomings.Nest, "smart" energy meters etc serve the same purpose.Quote from: TwoOfFive on March 19, 2017, 12:51:47 amIt's something I was first happy about, especially the new low-datarate network that allowed all my sensors to communicate to a global network, without every time a GSM unit+ de-facto 120 euro subscription cost per year per card.But more and more Lora, Sigfox etc show their true nature: Bigstate goverment tools.

author: 0b01010011
author_rank: Regular Contributor
timestamp: March 28, 2017, 09:40:28 pm
content: when some of these devices don't even have (or the manufacturer doesn't bother adding support for) DNS (https://www.eevblog.com/forum/chat/iot-%27sous-vide%27-cooker-device-reverse-engineering-video/) then I fail to see how they would be able to or care to implement SSL.Let alone any of the other security measures you need to take on a connected system. Miele's dishwasher webserver bug (https://twitter.com/mikelectricstuf/status/846140267707187201) says it all.Whilst these guys (as in appliance manufacturers) are great at appliances and appliance firmware, they have no deep understanding of the security side of IOT and simply bolt on what they canguy-in-his-back-shedstyle.

author: SingedFingers
author_rank: Frequent Contributor
timestamp: March 28, 2017, 10:19:57 pm
content: Can I just add as well that crypto is a cat and mouse game. You don't just flick the TLS switch and all is good. The implementations are volatile and under constant attack and upgrade. TLS implementations two years ago aren't the same today.The ONLY way you're going to get a TLS implementation that doesn't suck is to use a larger device such as a Pi or embedded PC and run an OS on it which has supported OpenSSL (or equivalent library) packages.And thus we see the demise of IoT as a good idea some more.

author: PlainName
author_rank: Super Contributor
timestamp: March 28, 2017, 10:53:57 pm
content: QuoteOn the contrary, the value it adds is the ability to talk to localised low-cost, low-power devices, and provide a single point of secuity/interface.Do you also consider your consumer unit to be an 'extra box which doesn't add value'?

author: nctnico
author_rank: Super Contributor
timestamp: March 29, 2017, 03:53:20 pm
content: Quote from: dunkemhigh on March 28, 2017, 10:53:57 pmThat doesn't add any perceived value to the customer because the customer and the competition don't care about security. A (for example) fridge which connects to internet using Wifi (=the existing router) is way easier.

author: PlainName
author_rank: Super Contributor
timestamp: March 29, 2017, 04:12:08 pm
content: Maybe I am not used to the modern world, but I wouldn't call a fridge a "low-cost, low-power device".

author: Kjelt
author_rank: Super Contributor
timestamp: March 29, 2017, 05:54:49 pm
content: As long as the device is only transmitting data such as a sensor for instance you do not need tls perse. Just Tx the data, if the data is privacy sensitive or you do not want anyone else to use it you can encrypt it with a PSK and algo of your choice.When you do want two way traffic you have to open a port on your (first) router and then you need to take precautions such as putting the device between a second router which protects your homelan. This is not different for an Iot device or a $2000 pc a dishwasher, IP camera or NAS. You need a mature DMZ or you be powned in weeks. Only exception mght be if your iot device is so stupid ( no os) that if it is hacked the attacker can still not use it to exploit the rest of your network,in that case a stupid iot device like an single arm cortex m3 is safer than a raspberri pi that runs an known and vulnerable exploitable os that needs regular maintenance and updates to keep secure.

author: PlainName
author_rank: Super Contributor
timestamp: March 29, 2017, 06:33:20 pm
content: QuoteTo... where?If we are talking discrete devices (like the fridge) then it needs to talk to somewhere. Something will have contacted it and asked for data. The alternative, that it sends to some cloudy thing, is simply moving the (unloved and pointless) hub box into the cloud, where it is worse than having it in your home.QuoteYou can do lots of things, but perhaps you wouldn't if you had any sense.Twenty years ago you would probably be right because that's how it was. But this is now, and we DO NOT want a phone app for the fridge, a different phone app for the microwave, another yet again different phone app for the lights, etc. What we want, and need, is asingleapp that will talk to everything. And to achieve that we do not want 'algo of your choice' infesting everything - it has to be a proper open standard protocol.

author: Kjelt
author_rank: Super Contributor
timestamp: March 29, 2017, 07:29:30 pm
content: Quote from: dunkemhigh on March 29, 2017, 06:33:20 pmTo some cloud instance/service with a domain name you registered and a good security solution such as azure or aws s3 or the likes. Not something you have to maintain yourself, i agree.QuoteYes and we want a lot of things like one single perfect OS on all computers etc.Reality is that the money is not only in the sale of the product but in the control of the product and the (big) data coming from the product. So all products being controlled from a single standard and app is not going to happen. Each manufacturer wants to keep in control of their devices so the best you can hope for is that they will allow a part of the interface as an open API for 3rd parties.

author: PlainName
author_rank: Super Contributor
timestamp: March 29, 2017, 07:35:08 pm
content: QuoteOh,come on! Just slap that hub in and be doneQuoteThat's not a good example, I think. We don't want the same OS (perfect or otherwise). We want platform agnostic data, which is what we have for computers and which we don't have for IoT. When you go browsing the interwebs, your specific machine doesn't matter. Use Chrome, Firefox, whatever suits you, but that website will still be accessible (mostly - some dorks do break this). Use ewelink to access a TP-Link light switch? I don't think so

author: nctnico
author_rank: Super Contributor
timestamp: March 29, 2017, 07:44:56 pm
content: Quote from: Kjelt on March 29, 2017, 05:54:49 pmWho is going to configure that port? The best way is to use a 'phone home' system where the device initiates communication to a certain domain name. The router acts as a stateful firewall allowing outgoing connections only. If the user has a functioning DHCP server in the router then this setup needs zero configuration from the user.

author: coppice
author_rank: Super Contributor
timestamp: March 30, 2017, 08:11:26 am
content: Quote from: Kjelt on March 29, 2017, 05:54:49 pmThe problem here is that people are very bad at figuring out whether data actually leaks something useful to a snooper. When you make some piece if equipment you seldom even know how it will be used, to even try to assess the implications of leakage. I have seen smart people take an enormous amount of convincing to show them how a snooper might make malicious use of data. The idiotic "I have nothing to hide" argument is very strong in many people.Quote from: Kjelt on March 29, 2017, 05:54:49 pmA pre-shared key offers no long term security. It will eventually be shared by everyone.

author: Vtile
author_rank: Super Contributor
timestamp: March 30, 2017, 11:47:55 am
content: Quote from: Red Squirrel on March 19, 2017, 12:43:26 amThis. IoT is in general a dead end, merely a buzz word from software industry (I suppose) and stepping stone to something worth to mention. The idea of this type of decentralised plug&play sensor, data acquisition and control is nice, but too idealistic to survive in real world. Most things now hyped on this field have been around in automation industry in different names with technically more robust implementation if not decades atleast a long time. IoT is something comparable to batteroo.

author: Kilrah
author_rank: Unknown
timestamp: March 30, 2017, 11:52:11 am
content: Quote from: msr on March 17, 2017, 07:28:06 pmThen you do like everyone beyond gimmicky gadgets does - sensors with low power local communication to a base station that is mains-powered and is akin to your Pi or router-like hardware and bridges to the online service.

author: Kjelt
author_rank: Super Contributor
timestamp: March 30, 2017, 12:49:28 pm
content: Quote from: coppice on March 30, 2017, 08:11:26 amIf the key is long enough, the algo still secure, the device is not on the open market for sale and the application not interesting enough for attackers to start bruteforcing, I think you are pretty safe.I wouldn't recommend it for mass products no, but for individual use. If you are so scared you change the PSK every year or so.

author: Kjelt
author_rank: Super Contributor
timestamp: March 30, 2017, 12:51:30 pm
content: Quote from: Vtile on March 30, 2017, 11:47:55 amYou sound like the people ten years ago that said smartphones would never get sold in huge numbers, too expensive and useless.

author: coppice
author_rank: Super Contributor
timestamp: March 30, 2017, 01:16:42 pm
content: Quote from: Kjelt on March 30, 2017, 12:49:28 pmThis is a weird argument. Who would develop something that's not for the open market? Who would want to change a pre-shared key in billions of tiny items spread across the globe each year?

author: coppice
author_rank: Super Contributor
timestamp: March 30, 2017, 01:23:00 pm
content: Quote from: Vtile on March 30, 2017, 11:47:55 amYou conflated some things there. Most of the press surrounding any new buzzword is ridiculous garbage. That's largely independent from whether there is something in there which will fly in the marketplace. For example, there are a lot of pull in the automation business, for what some call "sensor dust". A massive increase in the ability to provide fine grained sensing, through low cost remote sensors easily deployed by the billion.

author: Vtile
author_rank: Super Contributor
timestamp: March 30, 2017, 01:37:19 pm
content: I have never heard of the term "sensor dust", for that description it sound to be a signal noise. I kind of don't know where the "automation business" refers is it the real automation business / industry or software automation and datamining business (or what ever it is called this week).PS. Now when I think of it I have heard something that could be describet as "sensor dust" the old term were a soviet concrete.PPS. I can see the finely grained sensors to serve some purpose of a) person flow control (where people are and how to avoid traffic jams in huge building complexes) b.) HVAC or c) Home owners energy measurement .. all which a "littered by billions" would mean a direct catastrophy or just litter.Damn fever, can't think or type straight

author: Kjelt
author_rank: Super Contributor
timestamp: March 30, 2017, 01:46:03 pm
content: Quote from: coppice on March 30, 2017, 01:16:42 pmCompanies that sell the data as service to the customer, they keep their interface closed. To make the sensors support asym. crypto, like certificates etc will add significantly to the cost.So their choice.QuoteThat is the same with certificates, you need a revocation or update mechanisms or it is EOL of ALL devices when the secret is leaked.

author: technix
author_rank: Super Contributor
timestamp: March 30, 2017, 02:11:49 pm
content: The catch: the second you want to take things on your own hands to either shut down the connectivity or implement proper security (ChaCha20-Poly1305 can be surprisingly fast on a 32-bit microcontroller, while Cortex-M is running rampant) there is this hammer called DMCA whacking you right on the head and send you behind the bars. Ouch.So you have to buy things with connectivity in it (as non-connectivity version is deprecated and ceased to be sold) but you have no right to make it work the way you like it. Do you really own it then, or did you lease it for the price of buying it, with the manufacturer who actually still own this thing capable of terminating your lease whenever they like? Either fix DMCA so folks can implement the proper security and share it around without mega corporate sending FBI on their tails, or set up a mandate on security and privacy... Oh wait did GOP just tell mega corporate that consumer are not entitled to privacy?!?Maybe we should really start trying to document the procedure of building every piece of appliance from scratch and open source them... Big project ahead folks.

author: Vtile
author_rank: Super Contributor
timestamp: March 30, 2017, 02:19:57 pm
content: Quote from: Kjelt on March 30, 2017, 12:51:30 pmNope, I lusted the nokia communicator in the 90's, but as a snot-nosed schoolkid It were ofcourse just a dream. I actually did jump to the smartphone bandwagon before they got mainsteam the fist smartphones models were shitty at the time, but never though they would not be good and succesfull when a bit matured.In general the observation is just right they are too expensive (or were) and the benefits aren't so huge. The games and toy features are better than phones in the past though.People and collective hysteria is funny and a bit odd phenomenom.edit. I'll go to bed, I forget to type half of the words.Edit2: ... And you do skip the end of that sentence. In the end I say that it will be a stepping stone to something and that transformation is already happening with new protocols and all that sort of things. IoT as hyped : dead - IoT derivative in some form : will happen.

author: JulietMikeBravo
author_rank: Contributor
timestamp: March 31, 2017, 04:43:51 pm
content: Quote from: Galenbo on March 28, 2017, 09:28:07 pmCould you explain why those systems seem to be geared towards government use?I have been messing around with LoRa and The Things Network and the thing that bothers and puzzles me is the lack of affordable turn-key hardware. At the same time, all kinds of big companies are setting up LoRa/Sigfox networks for business customers. Seems that they are confident in setting up commercial networks, as if they know for sure there will be a lot of customers.BTW, The Things Network seems fine to me security-wise. No plaintext, all packets are AES encrypted AFAIK. Still planning on experimenting with it for a bit.In my opinion "mainstream" IoT can be a problem if it isn't properly secured. There is also a tendency to needlessly host stuff in the cloud. If a hacker gains access to a main server the hacker gets access to a lot of private data. If IoT data is processed and aggregated in a home device this is less likely to happen.At home I have some stuff that could be seen as IoT. Some Mysensors stuff and multiple ESP8266's running ESP-Easy. Everything is published on a local MQTT server which is not accessible on the internet. Mysensors does not do encryption but that doesn't bother me at this point. ESP8266 boards are on the WLAN so protected by WPA.

author: Galenbo
author_rank: Super Contributor
timestamp: April 02, 2017, 01:56:47 pm
content: Quote from: JulietMikeBravo on March 31, 2017, 04:43:51 pmOne of the actual big developments at the time is everything that is energy-related.Goverment can-and-will decide how and when you use energy.It will punish you for using airco/fridge/boiler with a time scheme, or remotely switch them on/off how they decide.Witch a sugar coated propaganda message on top of course, something with "fair" "we all" and their known tax-and-subsidize game.

author: JulietMikeBravo
author_rank: Contributor
timestamp: April 02, 2017, 07:51:55 pm
content: Quote from: Galenbo on April 02, 2017, 01:56:47 pmI don't really understand. The mentioned networks are just low datarate wireless networks enabling anyone to put sensors on everything. What does that have to do with energy use specifically?I think time schemes are hardly a form of punishing energy use. Personally I don't even have a time scheme on my energy subscriptions, and I am free to choose so. I see that energy companies fantasize about "smart grids" with remotely switchable devices. But I have never heard of such schemes being live. People are unlikely to accept stuff like that.

author: Galenbo
author_rank: Super Contributor
timestamp: August 12, 2017, 05:43:00 pm
content: Quote from: JulietMikeBravo on April 02, 2017, 07:51:55 pmThat's how I first "understood" it, and why I was extremely enthousiastic about it.And after attempts to get pricing, devkits, subscription etc at the time, I noticed they were very closed about info, had chosen their own development partners, and saw it popping up only in topics that can be described as people-spying and people-control.Quote from: JulietMikeBravo on April 02, 2017, 07:51:55 pma "solution" to monitor your diesel tank levela "solution" to get energy use per customer 24h/7new "smart" energy metersQuote from: JulietMikeBravo on April 02, 2017, 07:51:55 pm2 false claims.

author: Mr. Scram
author_rank: Super Contributor
timestamp: August 12, 2017, 07:48:23 pm
content: As they say, the letter S in 'IoT' is for security.