Item — HN Reader

Right now I'm writing my bachelor's thesis on IoT platforms. I think the real problem is that there's no real established pattern for authentication (the way there is for things like signing up for a web app). You ship devices and there isn't a 'one true way' for authenticating them against your platform, authenticating the user, partnering the user with the device, and then encrypting all traffic from the device to the local or public network.

Everybody uses their own homegrown solution, which depends heavily on the hardware they have to work with. This means that some companies get it right and many get it wrong. Yeah, the biggest problem is companies shoehorning connectivity to products, but the second biggest problem is that there really isn't a standard for securing that connectivity.

2 comments

Another thing about IoT gadgets and "smart"stuff in general, is the guaranteed obsolescence. It's not literally planned obsolescense, but when you install that wi-fi smartlock in your door, you know that it 5 years the company will stop updating the app that goes with it, and it won't work anymore under iOS 16, and so you'll have to throw it out and get a new lock, a new dimmer, a new garage door opener, new audio system, you name it.

> I think the real problem is that there's no real established pattern for authentication (the way there is for things like signing up for a web app).

No. The real problem is that a device you bought requires internet access for no good reason, spies on you ("collects information") with no good reason, and becomes useless garbage once the company that sells it goes out of business or decides to terminate the product line or just grows to dislike you, all that for your lightbulb in the toilet to dim to the beat of played music.

For IoT to be useful at all, the devices would need substantial configuration possibilities, like where and with what protocol send data to, or better yet, whom to allow to fetch data from the device. But this would be only for hobbysts, as general public is not interested in tinkering.

I agree with you, from the nerd perspective. The general public cares more about utility than privacy, unfortunately, but the equation is similar in both cases: are we getting more value than we’re giving up in control?

Much as HyperCard, Excel, etc have allowed non-nerds to solve their own problems or scratch an itch, there is room in IoT for these people to tinker. They just need the right tools and framing.