Killjoy :(. I thought the whole point of IoT was to be able to flicker your neighbour's lights, turn on music on your crush's radio and flush random toilets remotely.

(I'm only partially joking. Security and fun seem to be mutually exclusive.)

Unfortunately, some people have a different concept of fun from ours :P

Given your description I think this is the kind of thing that Client Side Certs are intended for. At least from the PC to server. on the server to IoT device side there are things like Z-Wave that do something like you describe (though proprietary and not well known how secure it is, to me at least). The big issue with signing alone though is that it can leave you vulnerable to replay attacks if you don't have some method to validate that it's a new request and not an old one. Typical methods i think are time based, e.g. command is only valid for 1 minute but this requires synced clocks on all devices. Or using an always incrementing number for each command and remembering which one was last sent which is easier on the device side but only allows a single master controller unless you get fancy on the master side.

The problem with client-side certs is that things go through a queue, yeah. CSC are only secure to the server, not to the other device. You're right about the replay attacks, that's why I include a timestamp. Since commands usually take less than a second, it works well enough, but sequence numbers work too, yep.

Hi StavrosK, you're right to be worried. We had someone playing with the API this week and sending wrong events. Security wasn't a primary concern for us, we started this as an internal joke (first version didn't even have a token system). Just to be clear, the light switch doesn't trigger a real light, but the way we handle sending sending the events from the browser is pretty dirty :)

Yep, you need at least a shared secret that isn't published anywhere for sending the events (reading them is fine if you're public).

That's a good point, since i'm no expert in security things, I'm struggling finding an adequate solution.

We have a private token, that the arduinos post along with the measure. It seems enough for our use case, but not at all for sensitive data.

Security in IoT is a big concern, an I need to know more about it.

There are things you can do, the problem is that the Arduino isn't powerful enough to do any sort of crypto on the chip. I use it as a peripheral to a computer, which just reads the Arduino and posts the data to the server. Signing/encryption happens there, but a Raspberry Pi would also be a good solution for that.