Directly connecting IoT devices to the Internet

[TerryE]

I've mentioned before about why I think that directly connecting any IoT device to the Internet is extremely dangerous, but if you don't believe me then watch this video. IMO, you should only open at most: an HTTPS port to a locked-down webportal and a strong authenticated SSH port, and possibly a VPN.

 

 

[ProDave]

Nobody has yet given me a good reason why ANY device in my home should be accessible outside it.  The usual one of remotely controlling your central heating just would not cut it for me.

[SteamyTea]

Just now, ProDave said:

Nobody has yet given me a good reason why ANY device in my home should be accessible outside it.

A door needs to be accessible from outside.

Here is my secret code, it is embedded in the shame.

 

[Ed Davies]

57 minutes ago, ProDave said:

Nobody has yet given me a good reason why ANY device in my home should be accessible outside it.  The usual one of remotely controlling your central heating just would not cut it for me.

 

It might not cut it for you personally but for others it might be more useful.

 

E.g., a friend of mine and his wife both flew for different airlines so had weird schedules and, of course, possible delays getting home at odd times and likely somewhat jet lagged. Running the central heating for other than frost protection while they were both away, sometimes for quite a few days, would be a waste but getting home to a warm house would be very welcome so either of them being able to turn up the thermostat from Heathrow was something we talked about.

 

Just for giggles I wrote a prototype shell script to watch for their flight numbers on some website or other with the idea that it could see when they landed. It amused me to think of directly (i.e., without human intervention) controlling the central heating off a 767 boggy tilt switch.

[MikeSharp01]

It seems to men that several things are fundamental and at the moment some of them contradict one another. So 

 

1. It cannot be an internet of things if no things are connected to it. (Intranets are of course possible and likely if not connected to the internet.)

2. Things connected to an internet of things must be securely connected.

3. There are millions of things that are already connected to the internet with varying levels of security and so it mist be feasible. EG Servers, routers, switches .......

3. There is a chance that IOT is just a fad and so might be overtaken by other systems.

4. Simply put the objective of the technology is communications (between things and things, people and things, people and people etc), the enabling technology is electronics and the controlling technology is software- mostly written by humans.

5. Once you add and idea to existing ways of doing things you add infinite new possibilities for this new combination of ideas. So while you add a device you also add opportunities for ne'er-do-wells as well as improving the general lot.

 

It will come. When I got my first mobile phone in 1986 people told me it would never catch on!

 

 

[SteamyTea]

13 minutes ago, MikeSharp01 said:

When I got my first mobile phone in 1986 people told me it would never catch on!

They probably meant that particular model, that weighed the same as a motorcycle battery, had limited coverage (a term that was not associated to the technology at the time), was very expensive etc etc.

I think people wanted a mobile phone, and could see the benefits, they just did not like what was offered at the time.

Bit like the the Matra/Renault Rancho.  Now the best selling cars are based on the same concept.

 

[Jeremy Harris]

23 minutes ago, MikeSharp01 said:

When I got my first mobile phone in 1986 people told me it would never catch on!

 

 

I didn't get a mobile until 1990, but it did become a much-used bit of kit.  I never went anywhere without it.  That's gradually changed, though.  First I started getting the feeling that the thing was dominating my life.  My employer seemed to think that having me "on call" almost 24/7, without paying me for the privilege, was OK, and I started to resent it.  By about 2006 I was getting into the habit of turning the phone off when I left work, helped by not being able to get a signal at home.  Now I rarely ever turn the mobile phone on.  We can't get a signal here and I really don't see any need for the thing.  Since January this year I've made two calls on it and received one...

[SteamyTea]

Oddly, since getting a half decent smart phone, I use it more.  I like that I can go for a walk and see how my steps match my heart rate, the route I have walked, speeds and climbs.

I can also post nonsense on websites, find out the time of tides, take pictures etc etc.

[ProDave]

I don't use my phone for much, mainly because I cannot abide trying to type anything more than about 2 words on a tiny on screen keyboard that is in any event taking up half your screen.

 

It is brilliant as a "consumer" of data for applications that don't need much input. I particularly like the GPS functions. It is a satnav for the car, a chart plotter for the boat, and a handheld GPS with maps for hill walking.

 

Occasionally I will take a photo accepting it is a poor camera.

 

The one thing I never thought I would use a phone for though is controlling my Pi Music box.  but again that does not require much input, just pushing buttons and the GUI for that has been written to work well on a tiny screen.

[Ed Davies]

It seems to me there are two reasons typical IoT devices are controlled over the internet (rather than just the local intranet). One is simply to be able to control it from anywhere but that's a pretty niche use case.

 

The other is simplicity for the developers. If the device has an internet connection it can get to their servers as can apps on mobile phones with hard-coded domain names. On the other hand, configuring IP addresses and so on for apps to find devices on a local network with different makes of routers and different operating systems on the phones, tablets, desktop computers or what have you is a lot more complicated and the cost of providing support could easily wipe out the income from selling one or a few devices. This is one (out of a quite a few) flaws in current internet architecture.

 

E.g., it'd be very helpful if there was a standard way to tell devices which controller to report or listen to. Something like DHCP giving the IP address and port number of the MQTT server to use, or whatever. I think DHCP can transport that sort of information but I haven't come across any way of setting that up on standard domestic routers. Even if you do have to use a central server initially then perhaps it could work to just introduce the app to the device and all further communication could be done locally so at least your lights continue to work when your internet connection is down. But doing that would likely run into all sorts of support issues in the face of NAT where the IP addresses the server sees aren't the real ones on the actual devices. And so on.

[SteamyTea]

@Ed Davies

Could that not be done, in time, with NFC.

Just tap the device to the phone, router, box of tricks and let it set itself up.

Might also be a way to hard wire in encryption.

[Jeremy Harris]

I've always had the feeling that the only reason that internet-type connectivity and protocols are being used to connect home controls and sensors is because there are a lot of people around who are used to coding for apps etc, so to them every problem looks like it can be solved with an app.

 

There are other ways to do this, though, that are inherently pretty secure.  I'm running a hardware focussed mesh network here, that uses a pretty robust wireless communication system.  It's cheap and reliable, and for me, as a hardware person, it's easy to code.  In around 4 years or so of having been working it's yet to crash or glitch, and comes back after a power outage within about 1 or 2 seconds.  It can't talk to the internet, but only because I've chosen not to provide that capability.  It could pretty easily serve data to some sort of web-connected device if needed.

[Ed Davies]

3 hours ago, SteamyTea said:

Could that not be done, in time, with NFC.

 

Yes, that might be one approach. I'm assuming what you have in mind is that NFC would be used to tell the phone what the IP address of the device is. But it would need extra NFC hardware on the device that would be needed just once or maybe each time the router allocates the device a new IP address. Perhaps Bluetooth LE would be another option for this as it could at least share hardware with the Wi-Fi interface.

[MikeSharp01]

Have spent a portion of today working through a load of papers on industry 4.0 and the IOT with associated security aspects of it. It seems to me that there is considerable demand / opportunity for rethinking the security of such systems although I am reminded of the old joke about getting somewhere by not starting from here. However there are some interesting ideas about how it might be done so I feel that the time will come when, put succinctly, everything will be connected to everything else quite securely.

 

 

[SteamyTea]

Will it be as secure as TOR, or a blockchain.

Both of those seem to have serious vulnerabilities now (was something in The Register about it)

[joth]

Of all the risks I think the most likely to hit is the cloud service just packs up and shuts down leaving the smart device dumber than a dumb device. Latest example:

https://www.theverge.com/2019/9/6/20853671/best-buy-connect-insignia-smart-plug-wifi-freezer-mobile-app-shutdown-november-6