2

My next personal project is going to be setting up some basic home automation for my parents (not very tech savvy but have a potential to learn). This involves some thermostat, lighting and notification control.
I have been using IFTTT in the past for them and it has worked really well so I am inclined to use it to reduce their learning curve. The recipes will mostly be the ready to use ones on the site or some custom recipes based on time of day and location of my father's phone.
Can the community share some security risks that I should keep in mind?
The only thing that I can think of is that my father's phone being lost or stolen is a big risk.

  • If you want security, I'd generally recommend you stay away from the Internet of Stupid Things. <-- Search this term for security advice – billc.cn Jul 5 '16 at 15:29
  • Why loosing the phone is such a risk (for the sake of this question at least)? – WoJ Jul 5 '16 at 20:24
  • If my phone is stolen, there is a chance the attacker can find my house as i was thinking of turning on the outer lights as soon as my parents reach near the house. – Limit Jul 5 '16 at 21:08
3

When using public services like IFTTT you must assume that you will be hacked. And then assess what can happen with all the knowledge a hacker may gain:

  • switching on a light? Probably not a big deal
  • fiddling with the thermostat? Except if your parents live in extreme climate conditions, this is not a big deal either
  • notification? depends on the kind of notification

In general, anything life-threatening (automatic alerts sent to doctors, pill distributors, ...) and potentially dangerous (electronic locks, ...) should not be dependent on a system you do not control, or at least being "generally accepted as safe" (having the green light from your medical institutions for instance).

Another element to consider is how easy it is to go from the identifier of the action to the physical address.

  • Having full access to your network because your 'smart thermostat/appliance' is insecure? big deal. – n00b Aug 17 '16 at 22:04
  • @n00b: IFTTT does not access your network. They connect to frontend services (such nest, outside of your network) which then rely the request to the device itself. When IFTTT get hacked you can assume that anything which is provided by the service can be performed on the backend device, that's all. – WoJ Jan 3 '17 at 19:47
  • Right i was reffering to the so called smart devices being vulnerable themselves not ifttt – n00b Jan 3 '17 at 19:49
  • @n00b: oh yes, these devices are inherently insecure when directly exposed, as seen in the recent IoT-based DDoS attack. – WoJ Jan 3 '17 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.