The Power of Choice

Story: Bruce Schneier on New Security Threats from the Internet of ThingsTotal Replies: 17
Author Content
dotmatrix

Mar 18, 2017
11:15 AM EDT
Bruce Schneier wrote:We can choose to opt out: not buy the Internet-connected thermostat or refrigerator. But this is increasingly hard. Smartphones are essential to being a fully functioning person in the 21st century. New cars come with Internet connections. Everyone is using the cloud.


If I buy a new appliance, do I need to connect it to the Internet? Can I just not use the Internet enabled 'features'?

The assumption that 'everyone is doing it'... is not the same as 'this is necessary to do'.

There are some technological jumps that are required to participate in in order to remain competitive within the society in which one lives. Participation in the IoT will always remain voluntary as long as free societies don't allow the government to mandate citizen use of such devices.
seatex

Mar 18, 2017
11:31 AM EDT
I guess I will never be a "fully functioning person", as I will never use a "smart" phone.
mbaehrlxer

Mar 18, 2017
12:50 PM EDT
the danger is that device-makers can make their devices depend on internet access. it's going to take a while until that happens, but it is a possible future that we need to consider.

with the phone it's already a reality. payphones have become all but extinct, so you you need a phone outside of your home or office, you can't get around mobile. it's only a matter of time until we have mobile phones that will not allow you to turn of internet access.

next are utility meters. already now they are more and more internet connected, and no, you can't turn them off, lest the utilities turn off your service. their use is dictated by the utility provider, and there will soon be no way to opt out.

same situation with TV. you could opt out of watching TV altogether, or accept that some day there may be no more TV that works without internet. (well, you could get a big computer screen or a projector instead, as hopefully there is enough market demand for having those function without internet access)

@seatex: count yourself lucky that you can survive without a smartphone. i'd lose contact with half of my friends. i'd be left out of social activities (the offline kind, because no-one could reach me and tell me about them), and maybe worse, i'd loose income because my customers could not reach me (ok, that last one did not happen yet, but the pressure is mounting).

the danger is not that we or our devices stop functioning without internet access. hopefully a fridge will continue to freeze even if the internet is down. the danger is that the internet access is forced upon us and we loose any choice to opt out.

for example: it is possible to run internet over power-lines. when that happens, there is no way for a layperson to disrupt that kind of internet access. all it takes is to make internet-over-power the norm, then have all appliances use internet access through the power-line, whether they need it or not.

it would also work with wifi. free wifi outside of your home. it's not yours, so you can't turn it off. all appliances use wifi, and you can't disable it without voiding your warranty or worse, without breaking the device.

that's all the ingredients needed to force internet access on people without any chance to opt out.

it's scary, but i think this is the kind of danger that bruce schneier is talking about.

greetings, eMBee.
dotmatrix

Mar 18, 2017
1:30 PM EDT
I'll make a few counter arguments:

>you can't get around mobile.

OK. This is still not a reason why an Internet connected phone is necessary. I can buy a cheap 'dumb' flip phone and use that to communicate with people or use in emergency situations. In fact, if I have a basic cell phone rather than a 'smart' phone, the battery life will be such that I know it will probably have enough power to call when I really need it.

>the danger is that device-makers can make their devices depend on internet access.

I will never buy a basic home appliance that requires Internet access to perform the basic function for which Internet access is not required for such device today. And I mean never...

>next are utility meters.

Utility meters are not a consumer device. Those meters do not belong to the end user. Sure... the electric company can remotely turn off the electric service... but how does that differ greatly from the control model that has always existed with utility services.

>same situation with TV.

Buying a 'smart' TV, does not mean that the TV needs to be connected to function as display. I have a 'smart' TV, but it has a Raspberry PI running OpenElec connected to the HDMI... so, the TV is not connected to the Internet, and I don't really care about the vulnerabilities in the TV or whether the system is recording me... because there's no way for the spyware to exfiltrate the data.

>it is possible to run internet over power-lines.

I used to work for a company that manufactured equipment to communicate over power lines. It's very unlikely that Internet connected appliances would be hooked into a power line Internet infrastructure unless mandated by government for the purposes of spying on citizens. If it's not a government sponsored program, the appliance manufacturer would need to pay the utility company for the Internet access over the lines. It's unlikely that the cost of connecting the appliances would be justified by the value of the data collected.
jdixon

Mar 18, 2017
9:29 PM EDT
>...you could opt out of watching TV altogether

We don't have any choice in the matter. No TV reception and no cable where we live. Dish and DirectTV aren't worth the price.
mbaehrlxer

Mar 18, 2017
11:04 PM EDT
Quoting:I will never buy a basic home appliance that requires Internet access to perform the basic function for which Internet access is not required for such device today. And I mean never...


sure, i would not either, but what do you do if manufacturers only produce internet-enabled devices? this is a question of market demand. you may not have a choice.

same goes for phones. you can buy a dumb phone now, but in 10 years? 20? 100?

Quoting:It's unlikely that the cost of connecting the appliances would be justified by the value of the data collected


that's what you believe now. but that could change. IoT devices get cheaper and cheaper. the price is not determined by its features but by the size of production. depending on demand an internet enabled IoT board may be the cheapest available for the appliance producers.

forget internet-over-power, wifi is more likely. the majority of IoT devices will be wifi enabled.

this will result in wifi enabled IoT boards being the cheapest to use for appliance manufacturers. whether they want to use it or not. and at that point it is only a matter of software to turn that wifi on and use it.

greetings, eMBee.
dotmatrix

Mar 19, 2017
9:10 AM EDT
>same goes for phones. you can buy a dumb phone now, but in 10 years? 20? 100?

There's a trendy thing going on right now in several markets where 'smart' phones are losing a bit of ground to rising flip phone sales. The reality is, not everyone wants a 'smart' phone. The market for simple phones will exist for the next 100 years, just like it has for the previous 100 years.

>IoT devices get cheaper and cheaper. the price is not determined by its features but by the size of production.

The cost of purely electronic functions may be cheaper in some cases existing in only a virtualized state sitting on 'the cloud'...

However, the cost of a toaster will always be defined by the cost of the metal, the heating elements, and the cost of the production. There's nothing to virtualize. So, the market for an Internet connected toaster is always going to be a small subset of 'trendy' consumers. Such devices will always occupy a niche market. A manufacturer is not going to make a entire class of products for which no primary functions are virtualized that every consumer must connect to the Internet for that primary function to work. It simply makes no economic sense.

A refrigerator that reminds you to buy milk is not the same as a refrigerator that requires you to connect it to the Internet to keep the milk cool.
mbaehrlxer

Mar 19, 2017
11:10 AM EDT
Quoting:A refrigerator that reminds you to buy milk is not the same as a refrigerator that requires you to connect it to the Internet to keep the milk cool.


right, the scenario i am painting is that where the market only produces refrigerators that remind you to buy milk, so that you do not have a choice but to get one, and further that they are built in such a way that they will use any available wifi without your permission, so that internet access is beyond your control if there is a publicly available wifi hotspot.

it is a pessimistic scenario that i am drawing here because i am pessimistic about the future in this regard.

the more technical among us will always find a way to stop such a device from connecting. but the majority of the population will not have the necessary skill, and they will end up having devices go online against their will.

we can argue at length about the likelyhood of this happening, but that is not an argument i want to make. i just want to point out what i believe is in the realm of possibility to support what bruce schneier fears is going to happen.

greetings, eMBee.
dotmatrix

Mar 19, 2017
11:42 AM EDT
>and further that they are built in such a way that they will use any available wifi without your permission, so that internet access is beyond your control if there is a publicly available wifi hotspot.

This will not happen, since there is no economic reason to do so.

All "automated reminder refrigerators" will always have an optional Internet connection. Please note that my 'opinion' is not an 'opinion' it is a economic reality based on the non-zero cost of the wifi, the internal electronics of the automated reminder device, the social cost of requiring something which many of your customers do not explicitly want, as well as other market factors such as limited availability and bandwidth of 'free-wifi' nodes.

Many of these IoT devices are gimmicky 'prosumer' type devices which have limited reach into the general market place. Many also depend on dense population center services, which leave out significant numbers of rural consumers.

I contend, with significant historical evidence, that the IoT 'revolution' will not be a 'singularity' event... it will be a gradual event in which many people of a certain tendency will participate. However, at least a majority of the world's population will not participate, or will only participate in the most mainstream way possible.

The 'augmented human' argument is a non-sequitur. Humans have been 'augmented' themselves since the beginning of consciousness and maybe even before... The 'smart' phone is not required for participation in the Internet Age. I don't have one, and yet I run several servers and contract myself out for network services... I answer emails and fix problems remotely, but do so from a terminal rather than a phone.
jdixon

Mar 19, 2017
11:04 PM EDT
> the majority of IoT devices will be wifi enabled.

And unless there's a unpassworded wifi router in range, there's no way it will connect to the Internet.
mbaehrlxer

Mar 20, 2017
12:51 AM EDT
more and more cities offer free wifi. however unlikely the IoT scenario is, wifi access is going to be available

greetings, eMBee.
jdixon

Mar 20, 2017
5:53 AM EDT
> more and more cities offer free wifi. however unlikely the IoT scenario is, wifi access is going to be available

I don't live in a city. There are a fair number of people who don't.
dotmatrix

Mar 20, 2017
7:25 AM EDT
eMBee:

I'm not saying it's impossible to have a situation where everything electronic is sending data to and through Internet.

The question is why? Why do it? What is the economic reason for having toasters send data through the Internet.

There are economic reasons to virtualize routers... there are political reasons to send information about daily activities to governments... but there are no economic reasons to enable widespread data collection from things like toasters. Furthermore, most end-users would not sign up to the data collection activities that currently exist if each customer had a lawyer explain to them in plain terms what they were signing up...

Here's my contention....

1. Corporations gather data now because of the economics of the situation. User data is very valuable, and in fact more valuable than the electronic surveillance device itself.

However, the user utilized Internet connection is the maximum collection point. All other points are less valuable and more difficult to mine. So...

2. Governments will need to mandate the collection of toaster data. Otherwise toaster data collection will not occur in widespread market exclusionary ways.

It's also an impossible argument to win, as are most. Time will tell...
mbaehrlxer

Mar 20, 2017
10:19 AM EDT
@jdixon: consider yourself lucky because you are already in a minority. more then 50% of the worlds population live in urban areas:

http://data.worldbank.org/indicator/SP.URB.TOTL.IN.ZS

https://en.wikipedia.org/wiki/Urban_area

@dotmatrix: agreed: time will tell. the question for me is whether to act on the side of caution or to be more optimistic about it. you are more optimistic, and there is nothing wrong with that. actually i really hope you are right.

i am with bruce schneier prefering to warn people about the danger to keep everyone alert and install a morality or ethics that will hopefully help to prevent the predicted outcome. of course, if successful we won't be able to tell whether it is because of these warnings or not, but that's fine with me.

greetings, eMBee.
jdixon

Mar 20, 2017
11:27 AM EDT
> more then 50% of the worlds population live in urban areas:

Since they said over 50%, it's less than 60%, so 40%+ don't. That's a lot of people. And even there, not all cities are equal in their access to the Internet. It'll be a fair amount of time before manufacturers can just assume their devices will have Internet access.
mbaehrlxer

Mar 20, 2017
1:16 PM EDT
free internet access and devices needing it go hand in hand. the more devices benefit from internet access, the more businesses will support free wifi in cities. a lot can change in a few decades.

as dotmatrix correctly says, it's a matter of economics. we are only disagreeing on what we think of as economical. for devices where internet access is important now, the mobile phone network is available. obviously more expensive again, but that too may change.

i am not interested in knowing how many people won't be affected, but i want to know how many are at risk. it's much less than 50% at this point for sure, but we can also assume that those in richer areas are more likely at risk than poor areas. but as we said: time will tell

greetings, eMBee.
jdixon

Mar 20, 2017
2:46 PM EDT
> ... a lot can change in a few decades.

More than 20 years out, the technological changes become too great to make reasonable prognostications. So yes, things can change significantly in a few decades. But we're not really capable of seeing exactly how. General trends are visible, but not the exact details. Since I don't see the cellular carriers ever offering free access, I don't think access will ever be ubiquitous in an area the size of the US. But we could get to the point where 80%+ of the population has free access, if of a limited nature.

Oh, and I'm not disagreeing with your concerns, merely about the details of how they might be realized.
mbaehrlxer

Mar 28, 2017
10:40 PM EDT
for anyone following this thread, here is the next installment: http://lxer.com/module/newswire/view/240605/index.html

Posting in this forum is limited to members of the group: [ForumMods, SITEADMINS, MEMBERS.]

Becoming a member of LXer is easy and free. Join Us!