Slashdot Mirror
A "Public Health" Approach To Internet of Things Security
New submitter StewBeans writes: Guaranteeing your personal privacy in an era when more and more devices are connecting our daily lives to the Internet is becoming increasingly difficult to do. David Bray, CIO of the FCC, emphasizes the exponential growth we are facing by comparing the Internet we know today to a beachball, and the Internet of Everything future to the Sun. Bray says unless you plan to unplug from the Internet completely, every consumer needs to assume some responsibility for the security and overall health of the Internet of Everything. He says this might look similar to public health on the consumer side — the digital equivalent of hand washing — and involve an open, opt-in model for the rapid detection of abnormal trends across global organizations and networks.
Thanks.
IoT is a bad idea.
Don't assign responsability to my grandmother for patching kernels using interfaces made by hardware people.
It will be a cold day in hell before I will accept having to authenticate to a 3rd party outside my network to access or access data that my devices generate on someone elses servers or devices. When I am able to open ports in my own firewall and access my devices and data directly without having to ask someone elses permission then internet of things will be a go for me. Until then I'll be a technically savvy luddite.
Digital is, by definition, imperfect. Analog is the way to go.
It strikes me that this is a bit unrealistic. The largest number of devices out there are designed for consumer use to consumer standards, which I think will mean massive security holes in the interests of quick to market and lowest prices. And the people that these are marketed to will not have even the smallest chance of keeping their devices cheap or noticing that anything is out of the ordinary until it is way to late. If you want a comparison to public health, think about the likelihood of an illiterate peasant in the 14th century having the slightest chance of escaping the black death other than by sheer luck, the chances of the village priest (who might be able to read) was not any better.
This is gibberish. lol.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
with this One Weird Trick
"Guaranteeing your personal privacy in an era when more and more devices are connecting our daily lives to the Internet is becoming increasingly difficult to do"
Waffle, how about designing 'computers' that can't be compromised by opening a malicious attachment or clicking on a malicious URL. ref
it just means Facebook is fucked because it can't track your movements anymore and the NSA is fucked because your data is encrypted. Seriously, the technology does exists to protect your digital information but that would mean people couldn't spy on you and make money off you so easily.
I agree with you, but it misses the crud (my opinion) which is TFA. TFA claims that we are all responsible for being good citizens and policing the internet because IoT and such. Which is crud because it lacks a sense of reality. Bad guys do exist, and people do bad things, regardless of how the rest of society is living.
If what TFA said was true, simply agreeing to give banks the ability to build vaults would have stopped all robberies. Countries that have outlawed guns for citizens would be completely free of gun crimes. And those are two really simple examples, human nature extends well beyond this.
The answer is for anything on the Internet to be protected, and if it can't be protected it should not be on the Internet.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Instead of all the hand wringing about future issues why not do things that really can be done right now to make life better. For example if our government announced a policy of economic punishment for any nation failing to arrest foreign hackers and turn them over to US courts we could eliminate boat loads of E-crimes against American citizens. Why should we tolerate Russia allowing pools of hackers dedicated to stealing American bank accounts or credit cards? Or how about a severe penalty for anyone not using a certain phone suffix for any call relating to sales so that we could totally shut down telemarketing. If we force the owners into bankruptcy for allowing just one call without that suffix we will kill off that industry which is 100% crooked. We won't even hear the phone ring as such companies would be electronically blocked before getting to our homes or cell phones. Of even greater importance we know that allowing coal to be used kills tens of thousands of Americans each year so how do we prioritize wrong doings when we allow the coal industry to murder hearts and lungs and poison our land and rivers? With all of these wrongs deliberately allowed to exist just how excited can I get over future issues with the net of things?
"every consumer needs to assume some responsibility"
Really? When *I* go online, yes, I have to assume some responsibility.
I hold the "things" up to the same standard: when the "things" go online, *they* have to assume some responsibility. It's not my f***ing fault if my fridge wants to surf the web, it's the fridge's fault.
When the masses decided on gaming, we went from games like Origin's with new IP every few months, to games that cost ten times as much (if you factor the DLC required) and are the same IP as last year. They decided that waiting a little bit more for a relatively bug-free version of a game isn't worth it, making the game industry with its, "it compiles, ship it!" mantra the de facto standard of today.
When the masses decided on smartphones, they went from units that had a week of battery life and had a nice slider keyboard (which was quite useful when doing SSH tasks) to error-prone tapping on a touchscreen, and battery life that doesn't last a workday. Yes, newer smartphones are so thin, they only have one side, but so much was sacrificed so that the devices can be thin, as well as run the latest version of real time rendered Chainsaw Crush at 60 FPS. It would be nice to not have as powerful a CPU in return for a phone that can easily fit in a standard pocket.
When the masses decided on what the Internet looks like, out went newsgroups, mailing lists, Web forums, and IRC. In return, we have Facebook, and Twitter.
Until they find a worse term for it.
It's not going to go away, nor should it. The only question is whether we're going to do it RIGHT, and every screeching whiner like you decreases the chance of that.
When they start making devices based on Genode, and can generate a Private/Public key pair for authentication by pushing a button, and share the public pair via a local web page... I'll be interested.
As long as these things are running some version of Linux, Windows or that ilk, they won't be secure, no matter how many updates and patches you apply vigorously.
Shame about the games and phones, but...
When the masses decided on what the Internet looks like, out went newsgroups, mailing lists, Web forums, and IRC. In return, we have Facebook, and Twitter.
These things are at least still around. Not as big as they once were, but depending on your areas of interest some are surprisingly active still. I actually know people who still use newsgroups! In particular on IRC, I find that while the number of active users has fallen, the signal to noise ratio in many places has risen - a big chunk of the people who left were the annoying trolling kids who are now bothering people through all the newer platforms instead.
What we need more is a base model of distrust.
The primary design error in networking was to trust other devices. If we had designed networking from the start under the assumption of malicious intruders, we would have things like "to do anything, you need a token that proves you're allowed to do it". It would be in the protocols.
On embedded devices, I want a networking stack that will cryptographically check all incoming packets, and at the lowest level discard them if they don't carry a valid token. Nothing gets even processed unless you are authorized to interact with the device.
Assorted stuff I do sometimes: Lemuria.org
When the masses decided on what the Internet looks like, out went newsgroups, mailing lists, Web forums, and IRC. In return, we have Facebook, and Twitter.
Which have begun to add in newgroups, mailing lists, forums and chats...
Assorted stuff I do sometimes: Lemuria.org
No, it's your fault for bringing a device into your house that has the potential to be compromised and spread misery to others without knowing enough about how to maintain its security through patches and other available upgrades. If you can't determine if that device is secure enough, don't buy it. If the manufacturers see that security is important to their customers (in other words, bad security is starting to cost them money, which is the most important thing, forget that 'quality' or 'security' shit) they will clean up their act.
Of course, this is free-market fantasy. Idiots will keep buying the shiny without any understanding of the implications. But I disagree that you're totally not at fault or not responsible for keeping your shit up-to-date with patches etc. If you turn off Windows Update, and you get infected with malware, guess what? You're partially at fault for disabling the manufacturer's provided security.
Never underestimate the power of stupid people in large groups.
When the masses decided on gaming, we went from games like Origin's with new IP every few months, to games that cost ten times as much (if you factor the DLC required) and are the same IP as last year. They decided that waiting a little bit more for a relatively bug-free version of a game isn't worth it, making the game industry with its, "it compiles, ship it!" mantra the de facto standard of today.
Maybe. I think the masses eat what they're fed. The above came about because game publishers wanted a revenue stream. It's like software licensing today. It's all subscriptions because software has outstripped its usefulness (Microsoft Office was a finished product 10 years ago) and companies are rent seeking to keep the money rolling in.
"What the American public doesn't know is what makes them the American public." -Ray Zalinsky (Tommy Boy)
So basically I'm responsible, because I didn't write the firmware, and instead it was written by an idiot? Like someone who runs Windows, and is therefore able to turn off Windows Update because it exists in the first place, and could be the very channel which, by means of DNS cache poisoning and/or router compromise and/or BGP poisoning, was the means to infect the thing in the first place?
How about we hold the idiot who thought giving the fridge a routable address via NAT off the local network in the first place, so that they could market specific brands of milk via coupons sent to me when I'm running low on milk, was a good idea, responsible instead?
You are responsible for what you can do. Of course you're not responsible for the firmware, but you have a responsibility to update it if it needs it. Balance the benefits WU gives you versus the risk in shutting it off for the average mouth breather; you can't save everyone but the chance of a compromise through WU is much lower than the risk of running an un-patched Windows machine. Leaving WU in its default state is the responsible thing to do, and that's the kind of responsibility I'm talking about. I don't expect the average consumer to be able to find and patch zero-days, but I DO expect them to know enough to not click on "punch the monkey" ads on the web, to know enough to install an anti-malware program, to know enough not to open attachments from people you don't know, to not run pirated software downloaded from some site in Elbonia, and to generally not be a fucking idiot. This is a perfectly reasonable set of expectations. The people who cause issues for others are the ones who don't do all that, who click on every banner ad in sight like a crack-addicted monkey hitting a lever, who send money to Nigerian princes, and are generally stupid enough to make people wonder how they tie their shoes. These are also the people who buy the shiny without knowing anything about how it works.
And how about not buying the fucking fridge if that's the way you feel about it? Nobody's got a gun to your head (that I know about, anyway)
Never underestimate the power of stupid people in large groups.
This is not going to be reasonable or even possible when devices are using obfuscated or poorly documented protocols which is becoming more prevalent. The best that the consumer will be able to do is isolate every device from every other (with a VLAN switch or equivalent) and block all incoming connections.
For example with Windows 10 or Windows 7 and later with various updates, how is the consumer to know via traffic inspection what is normal expected traffic and what is not? Even if you shut off all of the privacy destroying features, Windows still generates traffic. How do you distinguish this traffic from other malicious traffic?
Thanks for the useful article. Despite the fact that there are many new blogs and many other internet projects launched every day I believe that the blog created now may be promoted and made popular. In order to become an expert in the niche and attract people you need to learn and grow constantly. People want to read bloggers who are developing to grow with them. http://www.cutelovestories.net...