Hacker News Reader

Comment by crazygringo | Hacker News Reader

No matter how great security labeling may be, I fear the incentives are completely and utterly in the wrong place.

An individual consumer who purchases a poorly protected network device is unlikely to suffer any meaningful individual harm, like having their computer ransomwared.

Rather, it makes things like botnets possible that can be used for all sorts of things, e.g. DoS attacks against a third party.

So why should a consumer do anything but ignore the label? It's the rational choice if the less-secure product is cheaper.

If we want security standards, they need to be legislated democratically and applied to all devices -- not left up to consumer choice.

Now whether a legislature is capable of doing that effectively is certainly an open question. But I'm afraid labeling may be no more than an ineffective band-aid.

View on HN

> An individual consumer who purchases a poorly protected network device is unlikely to suffer any meaningful individual harm

It opens the door to liability for companies who purchase insecure network devices. If your peers are buying good hardware while you're buying self-identifying garbage, someone harmed by a botnet running on your metal has a better argument, now, that you were knowingly reckless.

But if there are a hundred million compromised TVs, toasters, refrigerators, and thermostats, liability for those few enterprises is largely a moot point.

I don't understand what you're trying to say here. The fact that companies will now be liable means that if even a single person is affected, not only is there clear liability, the kind of offenses that aren't sued for right now, because the payoff is to low to cover the court costs, are suddenly perfectly viable class action suits for amounts in the hundreds of millions of dollars against single manufacturers.

That's a huge shift, and about as far from "moot" as you can get.

I think what is being discussed here in liability for companies purchasing insecure devices, rather than the manufacturers of those devices.

It is reasonable to say that, even if companies are discouraged from purchasing insecure devices, that won't necessarily deter consumers purchasing insecure devices for their households. The threat from devices in households is perhaps even greater than in businesses, if the number of households in question is great enough.

> If your peers are buying good hardware while you're buying self-identifying garbage, someone harmed by a botnet running on your metal has a better argument, now, that you were knowingly reckless.

If every piece of hardware has the same label, that argument dries up and blows away.

If some piece of hardware doesn't have the label and later gets owned, the manufacturer will be held accountable. It would have to be, or else this is toothless. Since no manufacturer can predict which vulnerabilities may be discovered, and since legal teams are a cowardly and superstitious lot, every manufacturer will put the label on now to avoid any potential problems later.

Why even allow the sale in the first place. We don't allow the sale of faulty seat belts and say "well the consumer knew when they got it"

The only sales you can control are the ones that happen in your own country. I'm sure you can buy seat belts from Ali Baba at a fraction of the price, they'll probably be hilariously non-compliant to your country's safety standards, whether or not they work can be modeled by a fair dice roll, and I'm sure your insurer will deny any claims you make after installing them. But you can certainly buy them.

You may not be able to import them.

It's likely that if you literally fly out, buy them, pack them in a suitcase and fly home they'd make it, but if you try to buy a crate of obviously non-compliant Product X and it arrives at a port there's a reasonable chance somebody says "This Product X is non-compliant, so, why the hell is that here?" and you're not going to receive it.

You might think well, surely they don't look in most crates. And they don't. They don't look in the forty identical crates of compliant seatbelts going to Ford, because why would Ford be like "Hey, let's order 39 crates of complaint ones, but order 40 crates with #8 non-compliant to kill a few customers as a joke" ?

They're going to look in your crate because you never ordered any crates of seatbelts before, and "Bo Yang Belts" never sent anybody in your country a crate of anything before. Because their products aren't compliant to anybody's standards and so you're their first foreign sale.

But actually you may never even get to buy them. The huge first world economies like the EU and US order such enormous volumes of stuff and require compliance to their standards that it just often doesn't make sense to make Product A for them and then also Product B that's much worse but a bit cheaper for domestic use. I wouldn't like to guess if seatbelts are such a product.

Your answer seems logical but it is a real problem, see this article about Amazon repeatedly called out for selling deathtrap infant seats: https://www.bbc.co.uk/news/technology-51497010. They really do exist and really do make it across the fairly strict borders in the UK regularly.

But if we're holding companies liable for dangerous products... shouldn't we be holding the manufacturers liable?

What's the point is holding companies which purchase products liable for the quality of those products? That's a step removed for literally zero benefit I can see.

Just hold the manufacturers liable directly. In other words: standards, not labels.

The point in general for holding purchasers liable is maintenance traditionally for 'wear and tear' as opposed to defects.

To use a car analogy if your car gets into an accident because the break pads should have been replaced 10,000 miles ago that is your fault. If it is because the break pads disintegrate if they get wet that is the manufacturer's fault.

These aren't cars however, but it does bring to mind a hypothetical consistent set of standards involving patches. So if say the product was perfectly fine at launch on 32-bit platforms but it has a bug when run on 64-bit platforms it would become the user's problem.

It obviously wouldn't be a very good system, it isn't realistic in its expectations nor easy to judge or administer with all of the nuances and fine details of knowledge.

> An individual consumer who purchases a poorly protected network device is unlikely to suffer any meaningful individual harm, like having their computer ransomwared.

The number of stories I've read of poorly secured connected devices aimed at children. Stories of flaws so basic that it would be trivially easy for an attacker to get the child's location and send them messages posing as a parent.

Individual consumers will be very concerned about devices that could potentially allow their child to be lured to some random location and attacked.

I agree that security holes can have externalized costs. But I also think labels can make a difference, especially scary ones with words like "security".

Look at anti-virus software. While some of it is legit, a lot of it is garbage that doesn't do anything. But people will happily buy (or subscribe) because it promises to improve security. And fear sells.

I don't know specifically what the label is going to look like. But let's suppose that the government set 5 years of security updates as the minimum standard. And suppose that if a company only promised to provide 3 years, their product would have to bear a label saying, "WARNING: Does not meet minimum required government computer security standards. May lack software updates that protect from hacking." I think that would discourage a lot of people from buying it.

And conversely, if meeting certain security standards allowed the manufacturer to label their product as officially scoring "Very Good" or "Excellent", they'd want to put that on their label. Manufacturers always like to maximize the number of good-sounding things on the box. To the point that they'll invent useless bullet items to fill the space if they can't think of anything else to say.

> If we want security standards, they need to be legislated democratically and applied to all devices -- not left up to consumer choice.

A more important piece of legislation would be to require governmental security agencies to inform companies of the security flaws in their products and to require the companies to fix them. Organisations like the NSA stockpile security flaws in secret in order to exploit the flaws for their own ends.

The WannaCry malware caused worldwide economic damage and was a direct result of the NSA losing control of its EternalBlue exploit. Had the NSA reported the flaw to Microsoft the problem could have been fixed before it ever became a problem:

https://en.wikipedia.org/wiki/WannaCry_ransomware_attack

https://theintercept.com/2017/05/16/the-real-roots-of-the-wo...

It's unacceptable that these organisations are permitted to act like cowboys with our common infrastructure. These are not messes I want to spend my days cleaning up.

>If we want security standards, they need to be legislated democratically and applied to all devices -- not left up to consumer choice.

I get where you are coming from, and forgive me for going all libertarian but... I have less than zero trust in governments (especially mine in the UK). They don't understand tech. They don't want or try to understand tech. They have zero interest in personal freedom or autonomy.

If the UK government did this, I'd go out of my way to find a "non secure" phone as anything they licensed would just have massive insecure backdoors and probably wouldn't actually work as a phone...

Sorry for the rant. I'd honestly like more security in my devices...

> If we want security standards, they need to be legislated democratically and applied to all devices -- not left up to consumer choice.

But if you want security standards, and bob does not, why should bob be forced to want them?

Isn’t that the same argument that can be applied to health? Vaccines, clean water, fluoride etc promote your well-being, and protect you from various bacteria and viruses. Why shouldn’t you protect your “digital” self as well?

Isn’t this the healthcare argument but for security? Because it becomes an international problem when millions of EOL’d devices have a wormable flaw and can send enormous DDoS traffic stressing networks and taking sites offline?

Wouldn’t that be more of a problem if security is standardized though? If everyone has the same security, the same flaw makes everyone vulnerable. Multiple competing security types diversify the pool and prevent one flaw from causing all devices being susceptible to the same attack.

I fail to see how standardizing how long products are supported and how vulnerability reports are processed would cause everyone to have less security.

I can see it now. Anti-vax equivalents as IoT users...

“I refuse to change away from my Linux2 busybox/php based home automation devices. https gives you autism!”

(Maybe we can maintain “herd immunity” by abandoning ipv4, and moving the “healthy herd” all over to an ipv6 only internet?)

Because Bob puts others at risk by using an insecure device.

For the same reason Bob is forced to buy car insurance in case he hits someone else's car.

The botnet that infects Bob's equipment will harm others. The same way his car might.

That goes both ways though. GM/Ford/Tesla aren’t allowed to sell Bob a “less safe” version of their cars to undercut their competition.

I suspect the long term answer here might look a lot like the auto industry. You won’t be allowed to sell network-connecting devices that don’t meet certain minimum security standards. Manufacturers will need to commit to a minimum security update period (like car manufactures need to commit to spare parts availability - for at least 10 years after the sale here in .au), and purchasers will will be required to accept responsibility for device’s operation, some of which will be mitigateable by insuring against it, but irresponsible use will not be covered by insurance and become the owner’s responsibility. (Admin while Under Influence? Speed limits on pushing patches?)

I don’t see a clear path to that kind of regulatory control over $15 devices sourced directly out of China by every vanishing retailers/manufactures though, and there’s a whole raft of genuinely useful use cases for inexpensive net connected hardware that’d be impossible or illegal if the expense of the sort of regulatory burden place of car drivers was imposed on people with smart powerpoints or dash cams...

Oh, I bet enough consumers will make selections based on labeling that vendors will find it worthwhile to meet those standards to get those labels.

I know I will.

The internet, by it's core design, allows anyone to send as much data as they like with any content and pretending to be anyone.

I don't think mandatory security requirements for webcams is going to do much about that...

Instead, we should be thinking about how packets can be source and destination signed, and how unsigned packets can be dropped in the network rather than clogging up their destination.

Reply on news.ycombinator.com