<story><title>Mozilla debuts implementation of WebThings Gateway open-source router firmware</title><url>https://venturebeat.com/2019/07/25/mozilla-debuts-webthings-gateway-open-source-router-firmware-for-turris-omnia/</url></story><parent_chain><item><author>tialaramex</author><text>This the closest we have so far to an answer to the point raised in the IETF 105 Technical Plenary a few days ago.&lt;p&gt;Encrypting everything means that IoT devices represent an unknown threat - your &amp;quot;smart&amp;quot; TV connects to Sourceforge and downloads... something every week. What for? Your &amp;quot;smart&amp;quot; thermostat calls the IP of the vendor, maybe to get firmware updates, but it also calls the Disney corporation - what for? You can&amp;#x27;t snoop any of this because it&amp;#x27;s using encryption with pinned keys, so MITM doesn&amp;#x27;t work. Obviously hardcore reverse engineering is possible, but it&amp;#x27;s extremely expensive. So in practice it won&amp;#x27;t get done.&lt;p&gt;But, if we can popularize a safe option, we can just flag all the unsafe approaches that are popular today. We can teach vendors that this is a bad idea and they shouldn&amp;#x27;t do it, and (cross fingers) it might go away, like X-ray shoe sizing.</text></item></parent_chain><comment><author>degenerate</author><text>I was fascinated by your X-ray example. Here&amp;#x27;s a link for others: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Shoe-fitting_fluoroscope&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Shoe-fitting_fluoroscope&lt;/a&gt;</text></comment>
<story><title>Mozilla debuts implementation of WebThings Gateway open-source router firmware</title><url>https://venturebeat.com/2019/07/25/mozilla-debuts-webthings-gateway-open-source-router-firmware-for-turris-omnia/</url></story><parent_chain><item><author>tialaramex</author><text>This the closest we have so far to an answer to the point raised in the IETF 105 Technical Plenary a few days ago.&lt;p&gt;Encrypting everything means that IoT devices represent an unknown threat - your &amp;quot;smart&amp;quot; TV connects to Sourceforge and downloads... something every week. What for? Your &amp;quot;smart&amp;quot; thermostat calls the IP of the vendor, maybe to get firmware updates, but it also calls the Disney corporation - what for? You can&amp;#x27;t snoop any of this because it&amp;#x27;s using encryption with pinned keys, so MITM doesn&amp;#x27;t work. Obviously hardcore reverse engineering is possible, but it&amp;#x27;s extremely expensive. So in practice it won&amp;#x27;t get done.&lt;p&gt;But, if we can popularize a safe option, we can just flag all the unsafe approaches that are popular today. We can teach vendors that this is a bad idea and they shouldn&amp;#x27;t do it, and (cross fingers) it might go away, like X-ray shoe sizing.</text></item></parent_chain><comment><author>eb0la</author><text>&amp;gt; if we can popularize a safe option, we can just flag all the unsafe approaches&lt;p&gt;I am not a lawyer, but I think under european privacy laws those approaches are probably ilegal, too.&lt;p&gt;If some manufacturer (probably chinese) wants to grab data from people in Europe, they must comply with EU laws even if they don&amp;#x27;t have an office in the EU.&lt;p&gt;Not beign able to sell to a huge market is probably a better tactique, but not the only one to use.</text></comment>