Look for the label: White House rolls out 'Cyber Trust Mark' for smart devices The White House this week introduced a voluntary cybersecurity labeling program for technology products so that consumers can have some assurance their smart devices aren't spying on them. "The White House launched this bipartisan effort to educate American consumers and give them an easy way to assess the cybersecurity of …
I don't use IoT stuff. Not because of cybersecurity issues, but because it is overpriced crap for lazy rich people.
You buy it, you faff around installing it, it works for a bit, the company gets bought or goes bust, the servers go down without warning and YOU HAVE TO OPEN YOUR OWN GODDAM GARAGE DOOR. It's enough to push a lazy rich person past their tipping point.
Does the colour of the label relate to the particular NSA backdoor that is built into the device?
So it's not about creating an industry standard, inherently secure, vendor agnostic IoT protocol to make all these devices secure by default? Well that's completely missing the target and therefore a massive fail on all levels.
We don't want a 'trust mark', we need a protocol.
As for the data slurping, if the device/appliance/gadget insists it needs an internet connection when in reality is doesn't, boycott the vendor and go elsewhere.
"As for the data slurping, if the device/appliance/gadget insists it needs an internet connection when in reality is doesn't, boycott the vendor and go elsewhere"
This, exactly, there is a lot of choice today and building an almost air gapped home setup is fully achievable . Need to leave a port open for a VPN or control that's all.
Nothing needs to be outbound.
As for.being lazy and rich. That's just an excuse for saying that you are lazy and won't do the research. Learn to select or build your own equipment, it's more than possible with Arduino and a few components, you don't need the high end stuff in order to get good results.
'Rich' because all tech solutions cost more than getting up off the sofa to press a button. Like many people in the UK I no longer spend money if I do not need to, because our currency has been screwed by Brexit, our energy bills have been artificially inflated by the government, interest rates have been hiked, and what food there is in the shops costs twice what it used to a few years ago.
'Lazy' because we really don't need to automate most of this stuff. The more 'smart' stuff people use, the dumber society seems to get.
I also consider the addition of a layer of tech to anything reduces the resilience, so it is best avoided where possible. Before the net, nobody in Eastern Europe could take down your local council. If the power goes off in a school they now close it because the 'safeguarding software' no longer works. You cannot use some car parks without having a smartphone, a signal and a contract. The addition of technology does not automatically improve things, but it does add complexity and complexity increases the risk of failure.
I made my own IoT stuff. My server is a Raspberry Pi 3B+ bolted to the wall. My phone presents a certificate before it's allowed to open the door and it also checks the server certificate.
It was fun though, when I was trying to figure out how to generate and validate certificates, as I was a complete SSL noob. There were tons of posts on StackOverflow going "your SSL doesn't work? here's how to make it accept ANY certificate!" which is pretty pointless.
"It needs to look not only how secure is the hardware of your smart washing machine, but also how secure is the cloud where the company is storing the data that's collected through your washing machine"
Yep, definitely going to buy a washing machine that actually collects data on me because it's got a sticker on it telling me I can trust it.....
Rather than being trustworthy, the sticker points out that the device unnecessarily slurps personal data, and almost certainly the business plan behind such slurping means that there will be terms and conditions consenting to that data being sold on to third parties. Because there's not a cent to be made from knowing that I washed my undies one Thursday night.
This post has been deleted by its author
"...consumers can have some assurance their smart devices aren't spying on them..."
"...products that meet the NIST-defined testing criteria ... will be able to display the US Cyber Trust Mark and a QR code..."
This scheme "..."is not going to solve every problem...". No s**t Sherlock!!
Among the other problems would be.....NIST (!), the NSA (!), GCHQ, Five Eyes, Google, Amazon, Microsoft, Cisco, the NSO (you know...Israeli spies)....and so on.....
So....anyone having more trust because of the "US Cyber Trust Mark"....has been duped by the usual misdirection from the usual suspects.
Just saying!
Among the other problems would be.....NIST (!), the NSA (!), GCHQ, Five Eyes, Google, Amazon, Microsoft, Cisco, the NSO (you know...Israeli spies)....and so on.....
Might be safer ignore the labelled products and buy unlabelled Huawei then only have deal with Chinese (PRC) state surveillance.
A fuckton (metric or imperial) of "smart" devices are wired: TVs, washing machines, driers, dishwasers, fridges, CCTV systems, EV chargers...
Why don't these warrant the same dubious level of protection offered by this voluntary scheme (a scheme that won't be immediately gamed or faked, nosiree!).
And QR codes? Seriously!?! Teach people to blindly scan a QR code because it appears next to a "trust mark". Nothing can possibly go wrong with that.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
