New kind of micro controller developer environment - Page 1
Forum section: electronics / projects

author: TuomoK
author_rank: Newbie
timestamp: October 14, 2014, 11:46:01 am
content: Hello all!We have worked with developer board device project. Before we officially launch our project we would be happy to hear your opinions, questions and ideas about it.Am I allowed to share more specifications in this forum with you?Thank you for your help!BRTuomo

author: TuomoK
author_rank: Newbie
timestamp: November 10, 2014, 11:32:14 am
content: Hi!We have finally released our web page.Go and checkhttp://www.thingsee.com/BRTuomo

author: fcb
author_rank: Super Contributor
timestamp: November 10, 2014, 12:09:27 pm
content: Nice spec. Just backed it, look forward to April 2015.

author: TuomoK
author_rank: Newbie
timestamp: November 11, 2014, 07:54:23 am
content: Hello fcb!Thank you for backing! This is awesome!Let's spread the word to make this happen!-Tuomo

author: TuomoK
author_rank: Newbie
timestamp: November 17, 2014, 12:02:56 pm
content: Hello All!You can find more behind the scene material from our Kickstarter web page.https://www.kickstarter.com/projects/haltian/thingsee-one-the-smart-developer-device-for-mobileBRTuomo

author: lapm
author_rank: Frequent Contributor
timestamp: November 17, 2014, 01:44:02 pm
content: Looks nice, but could not find a word about security on that site. Is that secured somehow, since easy to hack IoT are all over headlines these days...

author: nctnico
author_rank: Super Contributor
timestamp: November 17, 2014, 03:06:59 pm
content: Quote from: lapm on November 17, 2014, 01:44:02 pmYou are right. What is holding the IoT back is the inability of cheap microcontrollers to have proper security. IMHO you can get very rich if you come up with a cheap I2C and/or SPI crypto chip which you can use to secure communication to an IoT device.

author: free_electron
author_rank: Super Contributor
timestamp: November 17, 2014, 03:22:10 pm
content: Quote from: nctnico on November 17, 2014, 03:06:59 pmthat does exist. simple 6 pin package. i2c interface. contains key memory and crypto engine. But only available under NDA.

author: marshallh
author_rank: Unknown
timestamp: November 17, 2014, 03:28:24 pm
content: There exist cheap security solutions like that but they only prevent hardware cloning, they won't fix the terrible software the nodes run. The first wave of deployed IoT crap will be just that; Internet of Targets.

author: Marco
author_rank: Super Contributor
timestamp: November 17, 2014, 03:29:29 pm
content: 32 bit micros can do SSL easily ... the problem is not the micros.

author: Kjelt
author_rank: Super Contributor
timestamp: November 17, 2014, 03:49:50 pm
content: Quote from: Marco on November 17, 2014, 03:29:29 pmStill pretty costly, the TLS stack will cost the same amount of ROM and RAM as the IP stack. Both together will set you back an easy 80kROM and 32kRAM not included the message buffers.Quote from: free_electron on November 17, 2014, 03:22:10 pmtotally useless unless you can make the ucontroller itself safe against firmware ripping.What they should do is integrate these devices inside the microcontroller and then encrypt the entire firmware, just decrypting it just before execution that would be some gain in security.Two years ago, pro-FPGA manufacturers that had this "encrypted" external startup memory were also hacked.The safest way of not being hacked is making something worthless and so boring no-one wants to hack it

author: Marco
author_rank: Super Contributor
timestamp: November 17, 2014, 04:32:05 pm
content: A little security by obscurity is nice as well, but I'd hope each device would have it's own key and no default login/pw (so reverse engineering one device wouldn't really get you much unless you found an exploitable bug).No bloody backdoors either, we really need some companies to be sued into bankruptcy for putting in exploited backdoors ... it's the only way things are going to change. In an ideal world some personal liability cases as well, but unless people die because of it that's not going to happen.

author: janoc
author_rank: Super Contributor
timestamp: November 17, 2014, 04:35:14 pm
content: Quote from: free_electron on November 17, 2014, 03:22:10 pmMaybe stupid idea, but why not use a smartcard as a "crypto engine"? But then you are back to a SIM card concept

author: Marco
author_rank: Super Contributor
timestamp: November 17, 2014, 05:05:10 pm
content: Crypto an sich is not an issue even on a 8 bit micro ... SSL as a whole is the issue (because people want to approach these things with a browser).

author: lapm
author_rank: Frequent Contributor
timestamp: November 17, 2014, 08:50:21 pm
content: Quote from: nctnico on November 17, 2014, 03:06:59 pmWell why not use higher end micro-controller for that? Seriously adding even simple encryption should be standard feature on any IoT system. Or better yet use powerful enough micro that can handle appliance code and crypto as well.If you choose to use too powerless micro that design decision that will bite its bossible market share. Not to mention exposing customers to blackhat hacker attacks. Personally knowing how crappy most consumer appliance software is, i would not trust anything that has IoT features in it.

author: janengelbrecht
author_rank: Regular Contributor
timestamp: November 17, 2014, 09:03:58 pm
content: Quote from: lapm on November 17, 2014, 08:50:21 pmBefore we know it...health equipment to supervise and regulate our body functions has IoT in it....black hats can then kill by hacking

author: TuomoK
author_rank: Newbie
timestamp: November 18, 2014, 07:46:22 am
content: Hi again!About that security thing...During the Kicstarter we will provide https for data transmissions.We have AES-128bit encryption support built-in our MCU available for developers.Future security features are under developing. We understand that security features are important especially for enterprise solutions.-Tuomo

author: nctnico
author_rank: Super Contributor
timestamp: November 18, 2014, 03:25:11 pm
content: Quote from: Marco on November 17, 2014, 03:29:29 pmNo they don't. I've been down that road and even a beefy microcontroller (>100MHz) with lots of RAM (>128kB) is still too slow for any serious encryption and too expensive.

author: Marco
author_rank: Super Contributor
timestamp: November 18, 2014, 06:06:05 pm
content: So MatrixSSL, SharkSSL, Cyassl are all full of it?ARM is going to support a free (but not open source) TLS component for their mbed OS BTW (a commenter on theregister thought it might be based on axtls). Regardless of quality at least it will be better priced.

author: nctnico
author_rank: Super Contributor
timestamp: November 18, 2014, 09:51:59 pm
content: Quote from: Marco on November 18, 2014, 06:06:05 pmYes. Like I wrote before: My opinion is based on my own experience. The weak (insecure) encryption algorithms are within the processing capabalities but if you want to use 256bit AES then you are screwed. And I'm not starting on the RAM requirements even if you have a hardware AES crypto engine.