Re: [105attendees] (re. plenary) measuring privacy, trusting devices and verifiability

[Robert Moskowitz <[e-mail]>]

https://us.cnn.com/2019/07/24/tech/nyc-cellphone-location-data-sale-ban/index.html

On 7/25/19 1:26 AM, Tobias Muhanguzi wrote:
> When it comes to security in IoT, consumers should have an opt out
> switch, and on top of that, security in design should be priority, we
> can't avoid the future, more so IoT
> ...@Richard
>
> On 7/25/19, Robert Moskowitz <[e-mail]> wrote:
>> Caveat.
>>
>> You no longer have control of the IoT in your life.
>>
>> Utility smart meters
>> Cars
>>
>> for starters.
>>
>> You want water efficient washers?  Buy NOW before they all are connected
>> IoT.
>> Do you use heating oil?  Select your provider carefully.  They are
>> putting IoT in your fuel tank.
>>
>> I know things about that AMI on my electric line.  I could have opted
>> out, maybe.
>>
>> On 7/24/19 6:40 PM, David Lamparter wrote:
>>> Hi all,
>>> (enter den of the lion)
>>>
>>>
>>> I find this discussion about measuring privacy, IoT devices and
>>> end-to-end encryption mildly hilarious and somewhat alarming.
>>>
>>> The /only/ situation where I will trust (and recommend others to trust)
>>> any device is when I have the ability to build and compare the code that
>>> runs on it.  I normally would want to be able to change it too, but
>>> comparing is enough.  We have reproducible builds these days, so we can
>>> even compare the resulting binary.
>>>
>>> And this goes all the way down to the hardware.  I'm only going to trust
>>> it if I can look at the design and compare it, even if that means
>>> slicing open the chip.
>>>
>>> It's not about billions of people each doing this.  It's enough that
>>> it's possible to do; a few people will do it and publish their results,
>>> and by random statistical sampling each of the billions of people can
>>> look at the maybe 10 people who did it, and make their *individual*
>>> decision to trust or not.
>>>
>>> In most cases this means open source, you can get into a discussion
>>> about signed binaries / inability to modify here, but it doesn't matter
>>> as the point relevant here is verifiability.
>>>
>>> And with that in mind, the only question I ponder is "what's the time
>>> span to FOSS availability on <buzzword>."  If you want to throw your
>>> data around, be my guest and join the hype train on whatever is the
>>> thing du jour.  Trying to make a privacy statement about smart toilet
>>> paper with closed source firmware is building on sand.  You may have a
>>> good grasp on the sheet you wiped your a** with, but the next one's
>>> gonna send your data to the Martian intelligence agency.
>>>
>>> So, should we make allowances in things like TLS for the user to break
>>> them to do a privacy analysis?
>>>
>>> *HELL NO.*
>>>
>>> The thing to break (into) is the devices.  Not our protocols.
>>>
>>> Cheers,
>>>
>>>
>>> -David
>>>
>> --
>> Standard Robert Moskowitz
>> Owner
>> HTT Consulting
>> C:248-219-2059
>> F:248-968-2824
>> E:[e-mail]
>>
>> There's no limit to what can be accomplished if it doesn't matter who
>> gets the credit
>>

-- 
Standard Robert Moskowitz
Owner
HTT Consulting
C:248-219-2059
F:248-968-2824
E:[e-mail]

There's no limit to what can be accomplished if it doesn't matter who 
gets the credit