Z Wave: WELCOME TO THE HOUSE OF THE FUTURE!

[MahrinSkel]

Tried posting this in the quick tech questions thread, but it's probably not a "quick" question.

Anyone know anything about Z-Wave? I'm looking into using it for a deadbolt and thermostat, and then maybe integrating it into some lighting. It seems like it's the "Smart House" concept finally grown up into something that doesn't take a team of engineers and constant fiddling to keep running, but I was wondering if somebody here had actually been using it already.

As far as I can see, a lot comes down to what hub you use, and you want to avoid the ones that need subscriptions, but are there any lurking compatibility issues, reliability problems, security issues, etc?

The idea of being able to rework a wiring plan (in terms of what switches control what, etc) without running wires seems really attractive, and the fact that you can set things up to control a dimmer from multiple locations is terrific. Smoke alarms that text you when they get triggered are kind of cool, too.

--Dave

[Baldrake]

I'm thinking it's worth waiting a few months before diving in on this kind of tech. For example, Apple's HomeKit is just gathering steam, which allows you to mix and match many manufacturers' home offerings into a single infrastructure. And Google has a new thing called Project Brillo for the Android world. I would personally be leery about getting locked into a single vendor when standards are emerging.

I say this as someone with an ecobee thermostat and a bunch of wemo smart plugs. They each have separate apps, and it seems that neither is going to be backward compatible with HomeKit.

[MahrinSkel]

That was part of why I was interested in z-wave, it's an industry standard (that other technologies like HomeKit, Nest, and MyQ have been built in top of). The UI for baseline Z-Wave hubs is generally pretty basic, but it doesn't lock you into an ecosystem or a subscription charge.

--Dave

[Baldrake]

Yes, today's WWDC clarified that HomeKit is Z Wave compatible, so you're not ruling out using your stuff with HomeKit down the road if turns out to interest you. I still know nothing about Project Brillo.

[MahrinSkel]

I won't let Apple control any aspect of my electronic universe, I'm not plugging those micromanaging morons into my physical shelter. They'd probably start deciding how bright my lights should be when I'm watching TV, and void my warranties when I plugged in a lamp to a dumb outlet, or some such "planned user experience" horseshit.

Anything that depends in any way on a manufacturer continuing to provide services to keep working is a non-starter, as far as I am concerned. Houses should just work.

Anyway, since I seem to be the designated dork for this particular tech, I'll keep you posted.

--Dave

[penfold]

*clap clap*

"Lights ON!"

[Teleku]

I do find it interesting that people are trying really hard to make the future as imagined by cyberpunk a reality.  Where a hacker can literally control every aspect of a building and has unspeakable power.  Which is cool and all, I for one welcome our private corporate army death squads.  But while I’m sure there are some cool uses for this tech, all I can think of is the mischief it opens yourself up to, heh.

[Merusk]

You're as paranoid as I am, Teleku.

Home automation is great as long as its a closed system. Open it up to the internet and you're asking for all kinds of problems. Watching what comes out of the blackhat convention every year because the corporate world is tech-stupid is often terrifying.  "Oh look, I can use a 13 year old's vocal diary to shut down your car's engine remotely using whatever veriant of OnStar your car's manufacturer used because LOLWHAT'SENCRYPTION?"

[Baldrake]

I won't let Apple control any aspect of my electronic universe, I'm not plugging those micromanaging morons into my physical shelter. They'd probably start deciding how bright my lights should be when I'm watching TV, and void my warranties when I plugged in a lamp to a dumb outlet, or some such "planned user experience" horseshit.

Anything that depends in any way on a manufacturer continuing to provide services to keep working is a non-starter, as far as I am concerned. Houses should just work.

Anyway, since I seem to be the designated dork for this particular tech, I'll keep you posted.

--Dave

Yeah, yeah, I get that a lot of people feel that way. My only point was that given that Apple and Google are both pushing standards, the incumbents may be looking forward to tougher times.

[Torinak]

You're as paranoid as I am, Teleku.

Home automation is great as long as its a closed system. Open it up to the internet and you're asking for all kinds of problems. Watching what comes out of the blackhat convention every year because the corporate world is tech-stupid is often terrifying.  "Oh look, I can use a 13 year old's vocal diary to shut down your car's engine remotely using whatever veriant of OnStar your car's manufacturer used because LOLWHAT'SENCRYPTION?"

Pretty much all of the "internet of things" gadgets are either intrinsically insecure, or have "security" that the designers bolted on as an afterthought. Some (like the "smart" thermostats) are so incredibly bad that security researchers don't even bother publishing about how horrifically broken they are except to come up with attacks that are so fast and simple that they could be run on a phone, or probably even on a non-smart watch. Z-Wave has had some critically bad issues in the past, and there's even an open-source tool that supposedly can be used to automate remote attacks.

Even absent of all of the direct security issues, these kinds of devices tend to leak information all over the place. The leaks can make it trivial for an attacker to determine, for example, which houses are unoccupied at what times, identify schedules of an entire neighborhood (making it much easier to pick break-in targets), and in some cases ("smart" power meters) identify which houses have what kinds of electronics.

These kinds of devices are intrinsically unsafe at best; the designers just don't seem to understand or care about security at all.

[Khaldun]

So far it also just seems to me that they're the 2015 version of kitchen trash compactors and electronic can openers--tech that everyone was being told was the new standard of our lives, which briefly appeared in a lot of middle-class show kitchens, and then vanished, because: a) who needs to compact their trash? and b) it's not that hard to open a can with a hand opener unless you have crippling arthritis and three hungry 80-lb dogs who won't eat dry food.

[Baldrake]

So far it also just seems to me that they're the 2015 version of kitchen trash compactors and electronic can openers--tech that everyone was being told was the new standard of our lives, which briefly appeared in a lot of middle-class show kitchens, and then vanished, because: a) who needs to compact their trash? and b) it's not that hard to open a can with a hand opener unless you have crippling arthritis and three hungry 80-lb dogs who won't eat dry food.

Not my experience. It's awesome to be travelling and be able to check in and see that your furnace is working at home. Or to be driving home after a trip and kick in the air conditioning an hour before you get back. Or if you're away to be able to fuss with the schedule for your lights going off and on. There are products that allow you to monitor that your pipes aren't leaking and to see who's ringing your doorbell at home and interact with them by video even when you're at work. You may not like the security issues, but you can't argue that the use cases aren't compelling.

[Hawkbit]

http://m.youtube.com/watch?v=B8DjTcANBx0

That should hopefully link to a black hat talk about camera security. Not sure where I saw it first, maybe here. It's pretty good though. ~80%  of cameras in use use admin/password for security details. So not only do you have to worry about the manufacturer creating a solid product, but your install has to be perfect too.

My primary concern is how much effort will companies put into these products as they grow older? Am I supposed to change my door lock technology every five years?

Not being super-tinfoil hat about it, but it just doesn't seem like a solid investment at this time.

[KallDrexx]

Not my experience. It's awesome to be travelling and be able to check in and see that your furnace is working at home. Or to be driving home after a trip and kick in the air conditioning an hour before you get back. Or if you're away to be able to fuss with the schedule for your lights going off and on. There are products that allow you to monitor that your pipes aren't leaking and to see who's ringing your doorbell at home and interact with them by video even when you're at work. You may not like the security issues, but you can't argue that the use cases aren't compelling.

I can argue that those use cases aren't compelling.  In the last decade I've only had my house broken into once, and it wasn't when I was on vacation (thus leaving lights on or off without changing them) but was at 8am because they were watching me to see when I left work.  None of the things you are talking about would have prevented it (hell even our security system would have prevented it) making most of the things you are showing very non-compelling.

Even outside of security related applications, how often do you really have people coming up to your door when you are at work that you need to interact with?  How often are you out on vacation that it's worthwhile to pay an extra $100+ for a NEST or equivalent thermostat when you can just get one that operates on a schedule and deal with waiting 20-30 minutes for the AC to kick back on when you get home from vacation (Even in 95 degree florida heat it rarely takes that long for my AC to stabalize again).

I have zero worry about the security of these devices or if someone is going to hack into my thermostat when I'm not paying attention, but I have yet to find an actually compelling reason outside of "oooh technology" for any of this IoT and interconnected devices.

[Polysorbate80]

Speaking just in terms of cameras, I've found mine used far less for "safety" than for confirming the activites of people around the house.  Such as, being on vacation and checking to see whether the person hired to look after the animals did in fact bother to show up on any given day.  Or pointing out to a delivery company that their "innocent" driver not only drove through the flower garden, but got out of his truck to see what he'd later deny hitting.  Or which drunken partygoer decided to steal the christmas decorations on a lark.

[Baldrake]

I can argue that those use cases aren't compelling.

And that's why I spend silly amounts of money on early tech and you don't. 

[KallDrexx]

And that's why I spend silly amounts of money on early tech and you don't. 

Pretty much.  I've been tempted to get a NEST and other similar things like that many times but then my mind blocks my justifications for it.  Then somehow a steam sale comes on and all justification blockers go out the window, or that NVIDIA console comes out and I immediately buy it.  I don't really have a rhyme or reason for my tech purchases :)

[MahrinSkel]

As far as security goes, if you aren't willing to install and pay the subscription for extensive alarm systems, you're already vulnerable to people willing to break glass, so theory-crafted cyberpunk Mission Impossible scenarios are pointless to protect against. I'm not even into that kind of thing and I know how to pick single-cylinder deadbolts and 'bump' locks, and a sledgehammer will get you past 99% of residential doors.

I need enough electronic security to keep mischievous teenagers with scripted tools at bay, anything more is mental masturbation and a waste of time.

--Dave

[angry.bob]

So far it also just seems to me that they're the 2015 version of kitchen trash compactors and electronic can openers--tech that everyone was being told was the new standard of our lives, which briefly appeared in a lot of middle-class show kitchens, and then vanished, because: a) who needs to compact their trash? and b) it's not that hard to open a can with a hand opener unless you have crippling arthritis and three hungry 80-lb dogs who won't eat dry food.

Yeah, pretty much this. Theres got to be some sort of thing going on in that industry because for the last two months we keep having people come door to door giving out info and trying to get people to sign up. I don't see any real advantage to it, I wouldn't want it connected to anything outside my house so there's no definitely no advantage, and it's just more shit to break that I can't fix. And really, how lazy do you have to be to not yell at your kids to go shut lights off or the thermostat down.

[Torinak]

As far as security goes, if you aren't willing to install and pay the subscription for extensive alarm systems, you're already vulnerable to people willing to break glass, so theory-crafted cyberpunk Mission Impossible scenarios are pointless to protect against. I'm not even into that kind of thing and I know how to pick single-cylinder deadbolts and 'bump' locks, and a sledgehammer will get you past 99% of residential doors.

I need enough electronic security to keep mischievous teenagers with scripted tools at bay, anything more is mental masturbation and a waste of time.

--Dave

It's not the difference between "safe" and "unsafe". Like so many other things, once it's on the Internet the scale and ease change entirely. Casing a single house, or even a neighborhood, takes effort and can be quite risky for the would-be thief. A hacker sitting in another county (or country!) selling lists of schedules or vulnerable neighborhoods is an entirely different beast. Taking a sledgehammer to a deadbolted door is very different than disabling an electronic security system with an app on the thief's phone.

And those "mischievous teenagers"? "Script kiddies" of yore are like what Barney Fife is to today's militarized US police force. They now have trivially easy access to top-quality ("professional") cybercriminal tools. "Script kiddies" can compete with the on-line security measures of the most security-savvy companies and governments. Even for actively patched systems, patches are routinely reverse-engineered and weaponized within hours of being released, in some cases becoming available in commercial exploit kits before the patches have been made available to vulnerable systems.

And you know that certain groups will absolutely love to remotely trigger, enable, disable, or otherwise screw with these kinds of systems on a massive scale "for the lulz".

Say, what happens to these "smart house" security systems when the house loses power? Do they fail open (leaving the house vulnerable) or fail closed (locking you in/out)?

[MahrinSkel]

In the case of the deadbolt, it's not going to be hooked up to the Z-Wave gateway, but into my private internal network (which I am confident can stand against these powered up modern script kiddies you're so impressed by). Nor will my z-wave gateway connect to third-party sites, and anyone who wants to break my firewall to fiddle with my thermostat and living room lighting is welcome to.

I didn't just discover all this internet stuff yesterday, you know. I'd give myself fairly good odds of stiffarming the FBI for at least a few days. Precocious tech-savvy teenagers don't scare me, I was one. Thirty freaking years ago, and I haven't just been coasting.

Save the "OMG THEY'LL STEAL YOUR IDENTITY FROM THE RFID CHIP IN YOUR UNDERWEAR!" stuff for the 5 o'clock news, I ain't biting.

--Dave

Edit: And in the case of the door locks, they are generally built around a traditional deadbolt (so you can still use a key) and are battery powered.