March 2021 - iot-wg - mailman.ripe.net

it's co-chair selection time!
by Jim Reid 16 May '22

16 May '22

My term as WG co-chair ends at RIPE80 or theresabouts. I will not be standing for another term. First of all, bringing in new and hopefully younger faces to freshen things up is long overdue. Second, I only volunteered to bootstrap the new WG. That has been completed. So it’s time to step away and let the WG find somebody else. There’s some info on WG co-chair responsibilities in RIPE692. Anyone interested in applying who wants more advice on what the job entails, likely time commitments and so on is welcome to contact Sandoche or myself. Or any other recent/current WG co-chair for that matter. I would also ask potential candidates to start a *new thread* -- eg "Your name for co-chair" or something like that -- when they post on the list so there are meaningful and relevant Subject: headers which make it easier to make a consensus judgement. It’ll save the current co-chairs reading every message on the mailing list to decide if they contain something in favour or against a particular candidate. This will also make it clearer for other members of the list to express their support (or not) for a candidate. Anyone can volunteer to become a co-chair and you can even nominate yourself. There’s no requirement to have N people nominating a candidate for them be considered for selection (for values of N > 1). Ideally, it would be good to be able to announce the new co-chair at RIPE80. Though that could be too short notice since the meeting’s just under 4 weeks away. If you think more time is needed to decide, please speak up. There’s no firm deadline and we should take our time about making this appointment - provided of course the new co-chair is in place in plenty of time for RIPE81. Although I think 4 weeks (ish) should be long enough to find a new co-chair, this is for the WG to decide too.

11 19

some experiences with deny-by-default for IoT devices
by Michael Richardson 29 Mar '21

29 Mar '21

The CIRALabs SHG project (https://www.cira.ca/labs/projects/cira-secure-home-gateway ) has been trying to get our systems into the hands of 50+ in-house alpha testers, but the pandemic has set us back: sorting people's network plumbing without visiting their house is a challenge. There will always be someone with something that just isn't wired up right, and non-technical people don't want to screw with their setup when they need it for minute-by-minute school work, etc. (Ironically, our home routers probably make their network better if wired right). So, our team has been onboarding devices and letting our SPIN/SHG hybrid system do analysis of the devices to form filtering policies. We have leant that this is harder than we'd like. For instance, I got a $20 Globe Suite single outlet back in December. It's in green so that it will match your Xmas-tree. https://globe-electric.com/en/product/globe-electric-wi-fi-smart-plug-no-hu… Our system is set up to accept new devices online, but to drop traffic from them by default until the administrator says, "okay". The device wants to put into onboarding mode by having a button held down for 5s, and then it flashes fast, and it is supposed to be discovereable by the phone. I'm unclear if it gets discovered by BT or via 2.4Ghz public frames. The app is repeatedly very specific: "Make sure you are on 2.4Ghz WIFI" My app just could not discover my device despite repeated attempts. No obvious errors, just "not there".... I went back to our SHG app, saw that in fact a new device was now present. (Yes, there is a bug with delays with Notifications that we haven't figured out yet). I then enabled access for this new device. NOW, I could onboard the device. Apparently, it attempts to join the WIFI, connect to Internet, and connect to the cloud, and if anything fails, then everything fails, and the device appears to not even be found! That's terrible UI. Now for the kicker: one might assume that the device is really controlled through the cloud then, right? So after plugging in a light to test it, and confirming I could turn it on and off with my phone, I turned wifi off on my phone, and tried to control it via LTE. What's the latency that way? Infinite, as I don't think it can be controlled via the Internet. Yes, you can onboard it to Siri,Alexa,Google Home, and I imagine you can control it that way. The device needs Internet to onboard, but doesn't apparently use it. Firmware updates? Maybe. The onboarding fails in less than human reaction time, so I could never actually enable access for the device via any kind of UI! -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

1 0

To be published: Architectural Considerations for IoT Device Security in the Home
by Constanze Dietrich 01 Mar '21

01 Mar '21

Hi everyone! Since RIPE 81, the "BCOP" document was refined again and now declared DONE under the title: "Architectural Considerations for IoT Device Security in the Home" (document attached). The next step is making it an official RIPE document which requires consent from the members of the working group. (Note: If you're subscribed to the list, you're one of them!) *As in previous queries the response on the list was rather quiet, this time I'll take silence as "Sure! Go for it! Great work!".* *That said, I strongly encourage you to read it and post your comments to the list.* Have a nice weekend! Constanze

6 7