Poster: A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic

The increasing popularity of specialized Internetconnected devices and appliances, dubbed the Internet-of-Things (IoT), promises both new conveniences and new privacy concerns. Unlike traditional web browsers, many IoT devices have always-on sensors that constantly monitor fine-grained details of users’ physical environments and influence the devices’ network communications. Passive network observers, such as Internet service providers, could potentially analyze IoT network traffic to infer sensitive details about users. Here, we examine several commercially-available IoT smart home devices and find that their network traffic rates reveal potentially sensitive user interactions even when the traffic is encrypted. These results suggest technical approaches for protecting IoT device owner privacy and indicate that IoT-specific concerns must be considered in the ongoing policy debate around ISP data collection and usage.