Slashdot Mirror
GlobalSign Supports Billions of Device Identities In an Effort To Secure the IoT (globalsign.com)
Reader broknstrngz writes: GlobalSign, a WebTrust certified CA and identity services provider, has released its high volume managed PKI platform, taking a stab at the current authentication and security weaknesses in the IoT. The new service aims to commodify large scale rapid enrollment and identity management for large federated swarms of devices such as IP cameras, smart home appliances and consumer electronics, core and customer premises network equipment in an attempt to reduce the attack surface exploitable by IoT DDoS botnets such as Mirai.
Strong device identity models are developed in partnership with TPM and hardware cryptographic providers such as Infineon and Intrinsic ID, as well as other Trusted Computing Group members.
Strong device identity models are developed in partnership with TPM and hardware cryptographic providers such as Infineon and Intrinsic ID, as well as other Trusted Computing Group members.
Another day, another example of "don't trust CAs."
The problem with IOT devices by and large is unneeded internet-facing services with default passwords, known remote exploits, and no interest from manufacturers in security patches after the sale.
You can put all the PKI you want into these products and the vendor will implement it with the same care as the rest of their software - ie. NONE.
While reducing the chances of future IoT getting pwned, how do we get current IoT devices out of botnets?
The problem with IoT is almost 100% due to default passwords or no passwords. The solution is not to add another complicated layer on top. This is bullshit. We just need to start producing products with unique passwords. Simple.
I just bought a new TP-Link Ethernet over Power adapter kit with built-in WiFi and to my surprise, it comes with a little card with the unique password for my particular unit, in case I ever have to reset it to factory. No more default password for every unit. It's that simple folks.
other than increasing the cost of a device, whats the plus side again?
The solution is not to add another complicated layer on top.
The proposed solution also presents a single point of failure for the cryptographic resource. If one company manages to get hacked, or infiltrated by one agent, or gets betrayed by one employee, everything will be lost.
Bruce Schneier had the analogy of putting $100 into each of 10 safes, versus putting $1000 into one expensive safe. The $1000 in a single place makes it cost-effective for a burglar to try to break in, while $100 in ten safes does not, even if the 10 safes are individually less secure than the one safe.
We've seen this principle in action recently: losing our clearance info database to the Chinese, and RSA losing its secureid seed database.
If the security of IOT devices is managed by one system, all it takes is someone to offer $500,000 to an employee for the root info (root certificate, or whatever the chain of trust originates from) and everything is lost.
HomeKit fixes the security holes quite nicely, thank you; even more so if you use Bluetooth rather than WiFi.
Then, the issue becomes all the other shitbox back-of-the-napkin "Protocols" that are insecure. If your IoT device supports one of those in addition to HomeKit, you could still be unsafe.
But as far as HomeKit itself, it is quite secure.
Seems fairly obscure - and "trusted" - it might just work!
(where work == generates lots of income for certain people)
Or just don't connect your toaster to the wifi.
Public PKI will not protect us from shit. It will only be used to grant government a direct backdoor or proxy back door, which means this will likely take off if people are not paying attention.
PKI operated by a pubic company is pointless. Additionally, it will do nothing to protect systems with week security as the PKI subsystem will just become the next target of the attacks likely raising the risk instead of reducing it.
PKI needs to stay right where it is at and be nothing more than securing a communications channel. An entirely and very interactive approach to letting users know what is running on their devices in real time is far more important. I am tired of looking at a computer and seeing cyptic names regarding what is running, the parts of the system the process is using, and/or the purpose of it.
Systems need to become discreetly manageable where access to things are easy to grant or deny per application without a bunch of complications. A PKI infrastructure will just reduce our own level of ownership of our devices even further!