Schneier on Security

Raining on your parade • February 21, 2020 12:19 PM

All you nay-sayers are missing out. People have internet-connected door locks and garage doors all the time, but all their friends don’t expect criminals to hack in and break into their houses constantly (perhaps because it’s way easier for them to just throw a brick through the window?)…

And electronically-controlled fireplaces are actually quite common, and it’s easy to hook up an ordinary switch to the internet as well. This way you can “set the mood” with another device, other than just the one hard-wired switch. Or as a group: dim the lights, set the music, and turn the fireplace on all at one time. And it’s quite safe, it won’t burn your house down or suffocate you, just waste some money on natural gas if you turn it on accidentally… This is because the fireplace is “installed” correctly, in a safe manner. Could it be used nefariously? of course! As anything can… That doesn’t mean it should be banned, nor does it mean every gas fireplace homeowner wins a darwin award for connecting flame to electronic ignition, making everyone shudder at their stupidity of not doing it the old fashioned way of lighting a match or rubbing two sticks together…

All the above could be said of this candle. There are only two main differences that I can think of between the candle and the fireplace:

1) The fireplace can be turned on and off electronically, whereas the candle can only be turned on electronically. You’re only half-way there to this being on the same level of convenience… It’s not set it and forget it, and then use this other device (wall switch, tap on phone, etc) to operate it… On the other hand, the candle does indeed “go out” on its own after several hours, when all the wax is used up…

2) Gas fireplaces are large and installed by the home builder, not the end user generally. There are specific instructions that must be followed, such as hooking up the flue to vent it outside, to make it truly safe. They also come with extensive shielding in front (i.e. big glass), which prevents accidental ignition of other things with it. So it is a real flame, but it’s not technically an “open” flame (it’s quite enclosed)… You have to go to quite some work modifying it to burn your house down with it, which can hardly be called an accident… This candle on the other hand is small, easily hidden, and always “installed” by the end user, not a licensed contractor… Installation consists of removing the cover (which prevents ignition, note this is good for storage), and situating it in a place where it won’t burn your house down (this basically means upright, and not with shreds of newspaper or your curtains dangling into it, etc). To be truly comparable, maybe they should have a bigger glass around the flame, and some sort of permanent vented top that prevents accidental dropping of things into the candle? At least it does have a glass around the sides though, so if it’s situated properly it should be just as safe as that fireplace… I know that’s a big “if” but still, we don’t ban things just because they might be misused, or we’d ban everything. We just try to get things to the point where the dumbest people aren’t killing themselves off by accident…

So, in summary, yes, some modifications might be needed to make this candle “as safe” as a gas fireplace… But no, I don’t agree that it’s fundamentally a flawed concept. Otherwise you should all be pro banning gas fireplaces as well.

Raining on your parade • February 21, 2020 2:08 PM

Now, that being said, here are some additional problems I see with this particular product:

1) It appears to be closed source and without any sort of API. As I mentioned in my last post, one of the benefits to having things become electronically controlled, is that a knowledgeable person can then “integrate” them with other things… and make whole scenes where you can turn on lots of things from one device at the push of one button. So this product doesn’t do the main reason I see for its existence.

2) It appears it doesn’t just have a “button” on the front to ignite the flame… but requires an app. I’d rather have the button be the primary interface, and the app (or an api) be the “and also can do this”… A button is useful, because you don’t have to get matches or a lighter. Lots of people don’t carry those around with them everywhere anymore since they quit smoking decades ago… Also a button without an app should be cheaper to buy, the electronics become way way simpler.

3) Possibly the reason for the last issue: the timeline says “Patents are filed for the first real flame candle light by an app” which suggests that they couldn’t patent any part of the mechanism itself… only once they packaged it all up and added “and do it with a computer [i.e. a phone]” then the patent office granted their patent… This is one of the biggest abuses of patents in recent years, in my opinion. The Electronic Frontier Foundation (EFF) agrees.

4) Since it is closed source, we can’t be sure it’s done well now can we? For example, it says, “can apply a password” which suggests this is optional? Is that a password just to access the app, or is the password encoded into the candle itself (so that anyone’s app on anyone’s phone requires the password)? What is the protocol and security between the app and the candle? We can’t tell any of this, because it’s closed! Is it Bluetooth? Is it WiFi? Is it cloud based? or local network? or some other sort of radio signal? What? Look, my biggest concern is that someone from the internet will figure out a way to turn on all candles around the world at once and that could be not only disastrous to the product, but potentially deadly since you have to figure a certain amount of users won’t have them “installed” correctly, if they’re not planning on using them at that moment (this was hinted at in my last post)… I need some assurances of control, before I can be happy with this, even on principle, and even ignoring the fact that “everything hooked up to the internet is probably hackable someday somehow, you just try to make it not a widespread problem in your lifetime”… And the only way I see that happening is with more information about how it works internally. Obscurity is not security.

5) Really? multiple people have been working on this for almost 5 years? I’ll wait and see, I don’t think that speaks to lots of experience with such manufacturing processes… Either that or it’s just way over complicated than necessary (see issue 2) and that means there will likely be issues…

There are probably more…