if that were a real concern, we'd all be encouraged to use VPNs everywhere, and when some large company stands to make money doing that without breaking Netflix, that encouragement will come
Incidentally, I see VPN advertisements all over semi-technical (gamer stuff, some mac-focused channels) youtube, and I've even seen/heard-of ads on TV. I also regularly see people comment with things like "but it's fine, I'm using a VPN" and the like, For as much of a bummer as this is, I think it's fair to say that there
is money in the "grifters sell you a VPN" market.
I'm also in the "I don't really believe my ISP has the technology or know-how to successfully ad-track me" camp but there are a few US ISPs that have said they can, one of them even started a deal where they had a special promotional rate on a speed package if you agreed to be tracked. (AT&T, in particular, with one of their fiber products, I don't know if it's universal or if it was one or two markets.)
Absolutely not! I think those internet connected cameras, smart speakers, thermostats, and other IoT devices and appliances
Quick note:
The reasons any given one of these things is a bad idea are largely unique to the particular device.
Ring, in particular, is bad because they sell access to footage from your front door to the local police departments.
Which is different from the potential security risk posed by, say, a thermostat or a smart speaker, which themselves are different from the risk posed, say, by an unpatched home router or an unpatched desktop or server system.
For the most part, IOT devices' threat to your network isn't any different from the threat of a Windows XP box or an old router that hasn't been patched in a while. It's a device making HTTP requests and there's the potential that it can be compromised.
Enthusiast-grade LAN systems are starting to feature VLANs, and that's one way to separate IOT devices (and appliances you don't trust) from your regular home Internet traffic, and something from, say, Unifi seems so far more likely to receive security updates for longer than your average retail home networking gear. Building your own is another option.
But, I want to pretty explicitly caution against talking about the security risks of IOT devices without thinking about the security risks of bigger, more capable, and much more performant computational devices left online using insecure/unpatched software.
The main difference, of course, would be that we can craft firewall rules to disallow traffic to/from the outside and, say, an OS X 10.6 box or a Windows XP box, where an IOT device is going to be pretty explicitly designed to talk to the outside. (Which is to say, they're both threats that need to be considered, even if the consideration is different.)
I'm not sure if this is true, there is this annoying trend where sometimes an app or device, if it detect that it's out of date, will actually shut itself down and won't let the user do anything until it gets updated to the newest version.
I'm curious to hear more about this, because I've never heard about this being a real thing.
Please consider finding out whether or not there are literally any documented instances of this and reporting back. I'd love to hear more.
Another option, regarding smart TVs, depending on the size range you want, is to use a computer monitor instead of a TV set. There are a couple 24-27-inch Dell UltraSharp displays that have audio output for the HDMI connectors, for example, so if you didn't need surround sound (or: your source hit an amplifier before it hit the display) you could use that as a display for whatever streaming device, computer, or TV/cable box you were using.
However, the only way, it seems, we can block say, for instance, tracking-by-credit card, is by simply not having a credit card,
I'm extremely curious as to what you mean by this.
Incidentally, there are services that let you spin up additional account numbers, but the main use case there is to safegaurd against a particular vendor having its information dumped. (i.e. you pre-authorized a charge of $50 to a temporary card number for something from a store that looked bad, to avoid sharing your "real" credit number, or worse, a debit card number, with an un-trustworthy vendor.
However, I feel the writing is on the wall on this one, as the likes of Google and Facebook will likely force the whole industry to switch to it (as they appear to have done with HTTPS and TLS1.2+, a move ostensibly done to promote better security).
Gonna argue that of all the things Google et al have done to make computing more annoying for people with technical know-how, these particular things are among the least bad. Arguably, good even. The browser vendors marked older SSL standards as deprecated or less secure for good reason, mostly that it's possible to brute force that type of encryption. If you look around, that
kind of thing isn't uncommon. SMB1 is well and dead within Windows, yuo have to dig pretty hard to be able to get to it and turn it back on, and SSH servers and clients have by default moved to stronger algorithms and ciphers. That's all in addition to things like pulling plain FTP and telnet servers out of things, where possible.
Those changes all make
really long-term inter-operability slightly more difficult, but they make things much more secure for everyone else.
In addition, it's not impossible to re-add/re-enable support for older less secure technologies in lots of scenarios. It's a bad idea, but it can usually be done if there's some reason to.
*(Incidentally has anyone heard of any effort on an updated build of MacSSH?)
So like, I would argue that the "
ostensibly" isn't merited here, for a lot of these kinds of changes.
Perhaps the only one I'll really agree with is the move toward demoting HTTP-only results of plain web sites with no interactivity or login. That feels punitive, especially in an environment where people using hosting services generating an SSL certificate for you doesn't appear to be a given.
