Is it Really Smart to go Smart?

No.

Installing a myriad of smart home devices (which seems to the ‘in’ aspiration of the day), is like building houses with all glass walls, ceiling and roofs  and no curtains.  You are leaving yourself open to wholesale prying and you will have no idea who is doing it, where they are or what is their intent.  If you are confident of setting up foolproof firewalls - and that is certainly not a widespread talent - you might get away with it.  But the security protecting the majority of smart devices is rudimentary to say the least.

While the Waily Mail (and other tabloids) are prone to hyping and overstatement, there is some truth in what they claim. Personally, I'd not bother with going ‘smart’ because it's (a) something else to go wrong, (b) something I don't have much need for and c) something which could (assuming the electronics companies which throw out these cheapo devices don't get their act in order) be used maliciously (DDNOS attacks etc.). Plus, while my fridge is chatting to my water heater or my microwave is discussing philosophy with the cooker, my home wifi is becoming cluttered with electronic noise and reducing my ability to watch cat videos on youtube!

Okay, so I could get a notification on my phone that I'm out of milk or the loaf of bread is nearing it's use-by date. I could just open the fridge door and check that for myself. It strikes me that the smart home is either geared towards incredibly lazy people who can't be bothered to get up and switch something on or off, or people who have way too much spare time!

A better alternative is to use a locally hosted server (e.g. Home Assistant), such no cloud/internet connection is required. It removes privacy, security and some availability concerns. 

Furthermore, WiFi-based devices indeed have additional security issues. A home router normally does not filter outbound requests, so having infected firmware is like having a spy living in your home. A better alternative is to use an isolated low-bandwidth network (e.g. ZigBee), which communicate to the internet with a single device that you can trust (e.g. Zigbee2MQTT), otherwise isolated from the internet. (no data collection about your daily usage)

PS: I actually write my final year thesis about this. So happy to provide more insight;)

Ben

Unfortunately the proliferation of WiFi gadgets is causing the problem.

Vulnerabilities in the TCP/IP stack are being found decades after it has been adopted worldwide, and with so many devices from small companies, which prefer to focus on “sexy” features rather than security, using WiFi is a risk. That's why, in the smart homes I design, I never use WiFi - I use instead ZWave or ZigBee which are built with security in mind, and where the gateway to the Internet is centralised  in a single point, easy to monitor and to upgrade.

I think we are still in a stage where smart homes are still being done by “cowboys” or DIYers with little knowledge of the security risks of connecting everything to the Internet.

The UK government has issued a proposal for a new law to regulate the security of IoT devices (https://www.gov.uk/government/news/government-advances-plans-to-boost-security-of-smart-products).

My hope is that the awareness of the risks, plus the government initiatives, will make Smart Home design and installation a specific job that requires training and qualification, and thus left to specialists - much like electrical installations.

To @Qbit : there are some very strong value propositions in the smart home market - e.g. smart heating, assisted care, remote surveillance, in addition to nice features such as smart lighting.

Of course there are also questionable ones - I'd never spend a quid on a smart coffee machine, unless it brings me the coffee while I am still in bed. But that's like the aftermarket gadgets for cars: most would never buy wheel rim lights, but some will ever do.

DMax: 
 

To @Qbit : there are some very strong value propositions in the smart home market - 

 

Agreed, but ensuring you protect fully against malicious intrusion  is essential if you don’t want your identity hi-jacked and bank accounts emptied.  Is ‘nice lighting’ really worth the risk?