Zigbee HA vs. Z Wave

[LarrylLix]

These writers love to find something, blow it so far out of whack, by using extremes from other technologies to further exemplify their ignorance, and make some attention getting article out of thin air nothing.
 
And that BS for what? So they can get their name out there in lights for their career and then sell webpage space for a higher rate to advertisers.
 
Go ahead hack into my Insteon devices and load code to spread a virus through the whole world that kills all of humanity.
ooops.... they have no eprom to write any code into.
 
Better find my toaster to contrive some drama about. Shooting toast out could injure somebody's foot and become infected possibly starting a plague, killing many  nations!
 
People have to learn to recognise garbage and use their mental garbage bins.

 

[wkearney99]

The network key vulnerability interval is very short so it's unlikely that a casual hacker can intercept it without a serious effort.  But, it's there along with other less easy to misuse flaws.

 
Things like hardware buttons to initiate sync are one way.  But of course that runs afoul of good old social engineering tactics.  "Hello, this is someone from the electric company.  We're doing a test and need you to reset your lighting controller.  Please tap the button..."  How many folks do you think would fall for it?  A great many, unfortunately.
 
Tangentially, this is why it'll be a cold day in Hell before I let the power company have any kind of access control into devices inside the house.  

 

[wkearney99]

People have to learn to recognise garbage and use their mental garbage bins.

 
It does do the service, at least, of reminding customers AND developers that security should not be left as an afterthought.  
 
Targeting Philips is perhaps deserved given how they royally f'ed up the lighting market with their attempts at proprietary grabs.

 

[LarrylLix]

 
It does do the service, at least, of reminding customers AND developers that security should not be left as an afterthought.  
 
Targeting Philips is perhaps deserved given how they royally f'ed up the lighting market with their attempts at proprietary grabs.

Agreed but the article bounces from Philips bulbs to every other mecahnism's weaknesses in an attempt to confuse the reader with shutting down the Internet from a Philips bulb.

Meanwhile people have been able to hack a Jeeps CPU and spray the windows, blast the radio, and shut off their brakes via a WiFi enabled laptop.

Real threats exist but in an attempt to get a piece of the action, non-technical, and ignoarnt, editorialists do a lot of grandstanding damage to promote themselves with exaggerated crap.

 

[wkearney99]

Life is all about attention-getting, that's not going to change.  Likewise, journalists won't always take the most accurate path to the truth when crafting articles.  Again, nothing new.   Worth a separate thread? Perhaps.
 
But in the context of one tech vs another it's a valid perspective to consider, even if poorly presented in an article.

 

[ano]

That's definitely unlikely. The problem is that, unless you make every automation system work the same, then they all need to consume the data from the device differently. And you aren't ever going to make every automation system work the same.

I just said it would be nice, but never had illusions that it would ever happen.   

 

[ano]

The Zigbee ZLL profile has several known security weaknesses, one of them and  perhaps the easiest to exploit is plaintext network key exchange on initial device configuration. Furthermore, there's no provision for the network key rotation in the standard, as far as I know.  The network key vulnerability interval is very short so it's unlikely that a casual hacker can intercept it without a serious effort.  But, it's there along with other less easy to misuse flaws.
 
Zigbee, however, at least attempts to address security concerns while Zwave had had no security provisions whatsoever (except locks) until gen5 devices.  Perhaps, 99% percent of all zwave gadgets communicate in plain text so any attack on lighting/thermostats is laughably trivial.

Are there really Russian hackers that have nothing better to do than to change the color of my LED lights? :huh:

 

[ano]

Tangentially, this is why it'll be a cold day in Hell before I let the power company have any kind of access control into devices inside the house.  

Hmmm even if they agree to cut your electric bill by 50% if you do so?  Programs like this that let electric companies control high-load devices (like your electric car charger) have been extremely successful.  Money talks.

 

[wkearney99]

Hmmm even if they agree to cut your electric bill by 50% if you do so?  Programs like this that let electric companies control high-load devices (like your electric car charger) have been extremely successful.  Money talks.

 
Not given their track record.  
 
Now, there's something to be said for load-shedding and effective management of consumption. I don't run my higher-load devices until off-hours anyway.  For lighting I can trigger a green mode to reduce consumption as a percentage and have it apply to any/all devices I pre-select for it.  It'd be sort of handy in situations like power-loss and running a generator.

 

[wkearney99]

Are there really Russian hackers that have nothing better to do than to change the color of my LED lights? :huh:

 
Or burn a few of them out and send a ransom demand or they fry the rest.  Or target specific individuals given on-line footprints and social media posting.  Or maybe they're just psychopaths that want to see the world burn.  Whatever, best to seek devices and systems with safeguards to avoid it.

 

[LarrylLix]

Here is another article written, perhaps with a little less drama and stays on subject matter somewhat better

http://www.nytimes.com/2016/11/03/technology/why-light-bulbs-may-be-the-next-hacker-target.html?smid=pl-share&_r=0
 
Do not read. I was insane at the time.

 

[emrosenberg]

Here is another article written, perhaps with a little less drama and stays on subject matter somewhat better

http://www.nytimes.com/2016/11/03/technology/why-light-bulbs-may-be-the-next-hacker-target.html?smid=pl-share&_r=0

 
That is the exact same already posted.

 

[LarrylLix]

 
That is the exact same already posted.

OMG! You're right! My apologies

Se what they have done to my mind already? You read something enough and you start to only seee what you want to see.

 

[ano]

Or burn a few of them out and send a ransom demand or they fry the rest.  Or target specific individuals given on-line footprints and social media posting.  Or maybe they're just psychopaths that want to see the world burn.  Whatever, best to seek devices and systems with safeguards to avoid it.

You may have a future as a crime author novelist.

 

[ano]

OMG! You're right! My apologies

Se what they have done to my mind already? You read something enough and you start to only seee what you want to see.

I think the sad fact is if Home Depot and Yahoo and LinkedIn and the US Government can't protect themselves from hackers, its doubtful efforts to protect your light bulbs will be successful either. If you don't want your lightbulbs to be hacked, don't connect them to the Internet.  I think long-term people will learn their lesson, and the need to connect everything to the Internet will wane.  Like for example, does the possibility that a hacker might remotely control your car and cause a crash that can get you killed really outweigh the benefit that you can remotely read you car's diagnostic codes 2 feet away on your computer?  Its doesn't to me.  I know I'm old-fashioned, but I live day-to-day with only Zigbee bulbs which don't connect to the Internet.