This is how ZigBee and Zwave work. The devices form their own network for inter-device communication (it can be setup so a switch talks directly to a bulb, so even if the network is unreachable it still works) and then you use a hub to orchestrate that and provide functionality such as phone control via an app. That can be something simple like a Philips Hue hub, or something more complex like SmartThings, or you can roll your own using Home Assistant and a dongle.

The problem with these protocols is although they are more or less open, device manufacturers need to pay to be certified.

Even if the hub was actually secure this still does not prevent from someone near to your house to talk to the devices directly (this applies especially to wireless devices). The hub you described would prevent from the remote attacks only

Security is a never ending rabbit hole. I am more concerned about the bigger threat, global attacks.

I get if you live in a densely populated area that drive-by type attacks would be very concerning.

>drive-by type attacks would be very concerning

not only that. One insecure system in the area could be infected and then controlled to attack other networks in the area. With a high density of IoT devices you could have malware spreading wirelessly device-to-device. Also with a wide IoT adoption with such devices being used by public/utilities companies (smart street lamps, leakage monitoring in pipes, smart electric grid etc) you don't even need a densely populated area to have that problem.

>I am more concerned about the bigger threat, global attacks.

I once read something among the lines that IT security needs its own Pearl Harbor event. I can neither quote it exactly or attribute it to any source

I'll tell you this. You already have a hub, it's called WiFi router.

I see zero reasons to rationalise the need to buy yet another white box for the buyer.

Wifi is a poor choice for this because it uses a lot of power. Lots of things that connect to a smart hub are tiny sensors that use expensive batteries.

The consumer have a choice, a device that works right away, or a better, more expensive one that doesn't

Think why they can't sell much of these

what do people mean when they say security for smart home devices? if the "launch ICBM" port is open on a device on your LAN doesn't an attacker still have to traverse your router to get to it? Otherwise, an attacker would have to get access to your LAN. Is something like that what you mean?

People would prefer

1. Their lightbulbs to not be co-opted into DDoS attacks 2. That their cameras are only used by them 3. That others can't control their devices 4. That their devices receive security updates 5. That their devices don't contain back-doors 6. That their devices can be used when isolated from the Internet

... I imagine.

Well said

Apple, Amazon, and Google are fundamentally opposed to a model that sells devices that don’t phone home - their whole purpose is to capture value by creating lock-in for surveillable hosted services

This is not exactly the case for HomeKit. Apple didn't even add the ability to control devices when you are off your home network until recently.

Yep. And it's Apple that's pushing for a HomeKit router [1].

Reading between the lines of how Apple's been handling the "smart home" business, they've been focusing on privacy and security relative to competitors, but it's been holding them back.

I think the market has kind of shown that privacy (e.g. devices that aren't streaming to / dependent on the cloud) and security have not been primary concerns of the people who buy smart home devices, but solving those problems better may be key to enlarging the "smart home" market to include normal people.

[1] https://www.computerworld.com/article/3446197/why-we-need-ap...

Seconded. Apple, Amazon and Google have very different goals for your data. This is just a transport layer. Your privacy from the mother company isn’t impacted by the transport layer, but rather where they put the “brains” of your smart home.

While all using the same transport layer they can continue to utilize different “brain” strategies.

Apple’s “brain” has always been in your home where your data belongs and should stay. Google started with the cloud but is moving towards the same model.

On the other hand Amazon seems to have no qualms slurping everything out of your home to their servers and no plans to change.

The more you know.

Not sure I understand. I am pretty sure you have been to remotely control Homekit since the beginning, originally by utilizing an Apple TV 3rd generation, and subsequently with iPads, Apple TV 4th gen/Apple TV 4K, and now HomePods.

Google and Amazon are like that. Apple is more into cross-selling you other Apple products and locking you into the Apple ecosystem.