Smart Home Primer

Twitter Facebook Google+

Pages

  • Home
  • About
  • Posts
  • How-to
  • Contact
You may have heard about it in the news, earlier this year two researchers from the University of Leuven, Belgium submitted their research for review, exposing a flaw in our WiFi security. They discovered a critical vulnerability they dubbed, KRACK, which affects the WPA2 security of ALL client WiFi devices. For clarity, examples of client devices are your WiFi connected smart home devices, laptop, phone, tablet, e-reader, etc.

Is this something you need to be concerned about? Short answer is, YES!


If you’re using any Android device, it is of particular concern, because this attack executed on an Android-based client can result in a complete breakdown of the devices wireless security until this is patched. Fortunately, the security patch is relatively simple, but you can expect manufacturers will want to test it to make sure it doesn’t cause issues before releasing. Expect to see big companies like Apple publishing it as beta (aka, not ready for primetime) at first.

Devices such as WiFi access points are at lower risk, unless they also act as client devices themselves to connect to other access points. Examples are wireless extenders and the new “Mesh Network” devices such as Eero, Google WiFi and Linksys Velop that connect together to extend wireless access throughout your home. However, unless you’re very tech-savvy, you may not be aware of a client capability your wireless router has, and there is a long history of exploits against wireless routers. Although less likely, it’s not impossible that a router could be attacked, have its client capabilities enabled, and then compromised. Therefore, please do update if possible, or check that your ISP has done this for you, if you are one of them millions that rent a wireless router as part of your Internet service.

How quickly smart home devices are going to be patched against this attack is anyone’s guess. The good news is many companies are taking this more seriously and reacting, now that it’s out in mainstream media. It’s also good news that many devices such as Insteon, Philips Hue and Lutron Caséta are unaffected by this, since they’ve never supported WiFi to begin with.

Although many companies already use HTTPS encrypted traffic, the researchers warn that this was easily bypassed in a “worrying number of situations”. The good news is, if you’re able to use a VPN connection to encrypt all your Internet traffic, you’re safe from attack, because all of your data is encrypted, and therefor unusable to an attacker the entire time you are connected to the VPN service.

Additionally, Mac and PC users do not need to be concerned, because the WPA2 protocol was never properly implemented by either Microsoft or Apple, which consequently made them immune to the attack, and official patches are already available.

Should you update everything you own that connects by Wi-Fi?  In a word, yes, but since it may be very difficult to know whether or not the manufacturer has updated your device automatically, or if it must be done manually, whenever you have the opportunity to connect securely via a VPN, we recommend you do so. This will make your life easier and take a lot of worry off your mind. It’s also important to know that this attack is very sophisticated at the moment, and requires an attacker to be within radio proximity such as free Wi-Fi in a coffee shop. But, black hat hackers do not wait to take advantage of vulnerabilities like this, and you can be sure a method of simplifying this attack is in the works, seeking those that are unknowingly still vulnerable.

To find detailed information about the KRACK vulnerability, be sure to visit the EFF post about it. For a list of updated devices and those not yet updated, BLEEPINGCOMPUTER is one site taking the lead on tracking this complicated issue.

Have a comment or question? Please gives us your feedback in the comments sections and do join us in the discussion on Twitter @smarthomeprimer where you'll find us posting about the latest news in IoT and smart home innovations.
Tweet
Share
Share
No comments
With so many choices and startups in the burgeoning smart home space, it's helpful to take a simplified look at the idea of the smart home versus the reality of what we actually have available today to make our lives more comfortable. Whether you're just starting or have already purchased some products, we hope you'll benefit from our experiences.

First let’s get this out of the way. The smart home we have today, actually has no intelligence at all. It's not really smart, but rather nothing more than cleverly connected timers and sensors with remote control. Even the early efforts to make smart environments more "intelligent" are still largely relying on you to respond to questions to fulfill the intelligence part.

In the 1950’s the first appliances to be electrically controlled by a timer were freezers in order to prevent frost buildup. Since then we’ve added more and more advanced timers, but haven’t really advanced automatic control beyond the timer before the early 1990's, when Passive Infrared Motion Detectors became affordable and their use increased. Today we see wider spread use of so-called Geofencing technology, which uses the GPS location of your smartphone to control devices.

Is a smart home only in the eye of the beholder?

A large number of the smart home devices available today are essentially timers and switches. Some are similar to traditional wall switches while others are part of an appliance, such as a light or coffee maker. There are some differences such as variable level settings, but the general function is simple on/off through user interaction or reaction. Your house and the appliances in it cannot actually think or anticipate change.

Hobbyists, enthusiasts and professional integrators have been almost silently breaking new ground in the home automation arena for a decade or more. But you begin to notice a certain pattern. Many have narrowed their focus so tightly on a single way of doing things, that the simple solutions and new technologies are often fuzzy outliers in their periphery.

Walk past the outdoor lighting section in any big hardware store and the security lights come to life, flooding the aisle with light to acknowledge your presence. But with so much focus on how to make a smart home do things like activate lights when you walk in the door or descend a staircase, simple occupancy sensing dimmer switches, available for a fraction of the cost of any smart home wall switch, proximity sensor or door switch are frequently overlooked. So much focus is directed to connecting absolutely everything, when really a single dedicated device might be more appropriate, and much more cost effective, rather than layer upon layer of devices, each dependent on the other to perform the simplest of functions.

You don’t need a thermostat or door lock to sense your presence, talk to a hub, go through an IFTTT Applet (If This Then That), communicate with a cloud server, relay the command back to your smart hub, and then send a wireless signal to a switch or bulb just to turn on a light. A single $30 occupancy sensing dimmer in your foyer when entering your home with your hands full or walk up or down the stairs is a great addition. Simple and no internet connection, smart bulb, WiFi or other radio signal required.


There are of course good uses and reasons to own smart devices and we don't wish to diminish the importance of the “WOW-factor” these gadgets hold for some people. This stuff has some very good use cases, some of which the masses are just beginning to realize. In fact, we’ve had several “Wows” from visitors just from lights smoothly increasing automatically as they approached a non-connected occupancy sensing dimmer.

Don’t try to solve problems that don’t exist

Designers and engineers of smart home products are paid to imagine products that quite often solve problems that don’t actually exist. It’s marketing’s job to then convince you that you have a problem that needs solving, when many times you don’t. For example a connected smart coffee maker may not be all that useful, since most coffee makers have timers built-in that are simple enough to use. The smart home should start with living in comfort and convenience as the primary goal, not a checklist of features.

Turning off a light from your bed with the simple touch of a button is a great use case. Turning off an iron remotely is not. All modern irons turn themselves off to prevent fires. If yours doesn't, throw it away an buy one that does. Don't rely on connected technology in place of safety features.

Be strategic about smart switches and devices
We think smart locks and video doorbells are a great place to start, so long as they offer convenience, have good digital security and offer strong benefits that make them a worthwhile investment. If you have a single entry, we favor the conversion type smart locks that do not eliminate the ability to use a simple key when needed or desired. A key will often be the fastest way for your to enter your home, even if it’s not necessarily always available or the most convenient.

Don’t rush to add smart switches, smart bulbs or other device to every single aspect of your life. It’s completely unnecessary since lights are incredibly easy to turn on, even if they’re not always easy for everyone to remember to turn off. Don’t overcomplicate this simple and reliable tool with unneeded and often unwanted extra technology.

It's true that when you want lights to turn ON and OFF by schedule so it appears someone is home when there isn’t, smart switches and smart bulbs can make a lot more sense then a simple timer. First, they can come ON automatically when the sun sets, so the ON time varies throughout the year. This is good if someone is “casing” your house or apartment. Also, turning ON major, high-use lights in the house is a lot more convincing than turning ON a single table lamp here and there. Turning ON and OFF various overhead lights throughout the house while you are out is going to be really convincing and should add just enough uncertainty to anyone thinking about breaking in. But the most important thing to keep in mind is that it doesn’t have to be every light in the house. This will save you hundreds to thousands of dollars on unneeded smart switches, smart bulbs and complicated setup.

Always use a switch, bulb or device that can still be operated by anyone in the house without internet requirement, having to pull out a smart device or control from a single central panel. Keep it simple! You may be enthused by what seems a “Jetson” lifestyle to you, but your family will very likely, not share your utopian vision. Put in a few devices that satisfy your craving for something futuristic and wow your friends without driving the rest of the household mad.


Your TV or music does not need to turn on the moment you walk in the house!

Gimmicks will become old quickly. Don’t blow your hard earned money on tricks that aren’t going to improve your enjoyment or ease of use. We're big fans of universal remotes and wireless music systems like Sonos, but we doubt you'll want your AV system turning on every time you walk in the door. They can’t predict your mood, so why would anyone always want them on when they arrive home? Ask yourself, do you always want to watch TV or listen to music the moment I walk in the door? What are the chances it might disturb someone else already a home?

Keep your activity as private as you can

You don’t know where or how the collected data about your movement and location is going to be used in the future. Even if one vendor says they don’t keep it, they either may not be telling the truth, which is too often the unfortunate reality, or there is another partner in the automation puzzle which you did not consider or know about, and they may not be bound to the same privacy policy, or any privacy policy at all.

Data about you is going to be used in future ways that you will not like and there will be little to nothing you can do about it after the fact. It may also set precedence for future privacy violations of your children and later generations. Keep it private from the start and they’ll have nothing to gain from you. We're not referring to consenting fair use scenarios such as Google services where there is proper disclosure and opt out possibilities, but rather data that is captured and stored without your knowledge and/or consent.


Send us your questions and thoughts about this subject. Leave a comment or send us a tweet @smarthomeprimer
Tweet
Share
Share
No comments

About Us


About Smart Home Primer


We help big brands with the big responsibility to get it right.

Follow Us

  • Twitter
  • Facebook
  • Google+

recent posts

Previous Posts

  • ▼  2017 (5)
    • ▼  October (1)
      • Your KRACK is showing!
    • ►  May (1)
    • ►  February (3)
  • ►  2016 (3)
    • ►  October (1)
    • ►  February (1)
    • ►  January (1)
  • ►  2015 (1)
    • ►  April (1)
HOME

© Smart Home Primer 2017 - All Rights Reserved