# Easier Said Than Done: The Failure of Top-Level Cybersecurity Advice for
Consumer IoT Devices

Veerle van Harten, Carlos Hernández Gañán,
Michel van Eeten, and Simon Parkin
TU Delft, Delft, The Netherlands
{v.t.c.vanharten, c.hernandezganan, m.j.g.vaneeten<EMAIL_ADDRESS>
###### Abstract

Consumer IoT devices are generally assumed to lack adequate default security,
thus requiring user action. However, it may not be immediately clear to users
what action to take and how. This uncertainty begs the question of what the
minimum is that the user-base can reliably be asked to do as a prompt to
secure their devices. To explore this question, we analyze security actions
advocated at a national level and how these connect to user materials for a
range of specific devices. We identify four pieces of converging advice across
three nation-level initiatives. We then assess the extent to which these
pieces of advice are aligned with instruction materials for 40 different IoT
devices across five device classes (including device manuals and manufacturer
websites). We expose a disconnect between the advice and the device materials.
A stunning finding is that there is not a single assessed device to which all
four top pieces of converging advice can be applied. At best, the supporting
materials for 36 of the 40 devices provide sufficient information to apply
just two of the four pieces of advice, typically the installation and enabling
of (auto)updates. As something of a contradiction, it is necessary for a non-
expert user to assess whether expert advice applies to a device. This risks
additional user burden and proxy changes being made without the proposed
security benefits. We propose recommendations, including that governments and
researchers alike should declare their own working models of IoT devices when
considering the user view.

##  1 Introduction

Currently, users of smart home devices (e.g., smart TVs, home appliances) are
expected to configure and maintain these devices [1, 2]. Many national-level
initiatives have emerged, to advise consumers on how to secure their devices
and to check security configurations. There has been a laudable drive to
assess users’ abilities to secure their smart devices (e.g., [3, 4, 5]).
Conventionally, the usability of advice is tested by conducting a study where
users’ ability to apply the advice is tested. These kinds of research designs
are in-depth, facilitating only a small set of advice or recommendations to be
tested. Further, usability studies typically test advice which has already
been qualified as applicable. In the past few years new studies have emerged
that zoom out and look at the overall landscape of large corpora of security
advice in the hundreds [6, 1], some specifically for IoT [7], evaluating
properties such as clarity and actionability. Such work can answer questions
about the properties of security advice as a phenomenon (and its over-
production [6]), though it cannot determine if advocated actions can be
applied in specific cases or environments. This can only be done by looking at
the advice itself rather than involving users since that is not feasible for
thousands of pieces of advice.

Between these two areas of work is a large gap which we need to address,
especially for IoT security, to determine what it is that we should expect –
and encourage – smart home device users to do, to sufficiently secure their
devices. These recommendations need to function for an enormous variety of
devices. Here, we approximate the user experience by looking at support
materials for specific devices. This can scale to a larger set of devices than
a classic user study can, while not being restricted to the advice text
itself, as the large-scale studies are.

To improve our understanding of IoT security advice, with its enormous
heterogeneity of devices, we propose a study design that operates in the
middle ground. Here we evaluate the current foundation of cybersecurity
guidance for IoT devices and assess whether top pieces of advice aimed at the
general public align with the properties of IoT devices as described by
manufacturers and third-party sources.

We select advice from three countries in the top 10 of the Network Readiness
Index (NRI) of 2021 [8]: the United Kingdom, the United States, and the
Netherlands. We investigate two research questions: (i) What is the baseline
of convergent advice to users for securing consumer IoT devices?, and (ii) How
does the identified baseline of convergent advice align with the content of
support materials that users have access to, such as instruction manuals,
videos, and organic search results?

We found divergence in what was advised to users, but also four convergent
pieces of advice related to passwords and updates for IoT devices. We explore
the degree to which these four pieces of convergent advice can be applied
using the support materials for 40 IoT devices across five device classes
(Sections 5 and 6). Instead of purchasing each device, we utilized a scalable
approach by analyzing resources that average users have at their disposal,
specifically the accompanying manual, quick guide, manufacturer websites,
instruction videos and organic search queries (as a means to capture features
which were not mentioned in these materials). The latter includes 746 browser
search results, and 626 YouTube results (212 and 76 from manufacturers,
respectively), which were analyzed manually. Our contributions are as follows:

  * •

False applicability of not-fit-for-purpose, public-level advice. We expose a
systematic misalignment, more a break, between convergent public-level advice
for users of consumer IoT devices (as provided by governments and public
bodies) and security features supported in – and prompted by – the available
device materials and online resources for a sample of 40 smart home devices.
For the convergent pieces of public-level advice that were selected, we find
that there is not a single device where we can apply all four pieces of
advice. This means that as general advice, it is fundamentally not applicable
and not fit-for-purpose, and hence is not correct advice for many devices.
This is a finding that device-agnostic user studies and deep-dive, device-
specific investigations have not exposed;

  * •

Absence of feature confirmation risks proxy changes. Combined with the
aforementioned lack of applicable top-level advice, we expose the potential
for proxy changes that offset any benefits – it is not the case that any
effort spent on security is worthwhile if it does not achieve its specific
aim. We characterize a contradiction, wherein a user is required to have
expertise about their device before they can understand whether security
recommendations aimed at helping non-expert users apply to their devices;

  * •

Scalable Internet-driven analysis of diverse consumer IoT devices. In
exploring our aim of identifying the basic steps that users of consumer IoT
devices can follow, we develop and utilize a method for examining available
advice in relation to device features. It scales better than user studies and
expert examinations with physical devices, while still being able to evaluate
the actionability of advice for individual devices, rather than being confined
to the advice text itself, as the large-scale studies of security
recommendations have been. Given the great diversity of IoT devices, there is
an urgency to find approaches that are accessible to a wider range of
researchers, which are less costly and resource-exorbitant. Here, we use the
accessibility of online device advice to map the existence of specific
security-related device features.

We revisit our research questions in the Discussion (Section 7), including
recommendations such as surfacing researchers’ and policymakers’ own mental
models of IoT devices, and a push for consistent terminology to connect high-
level advice to device features. We close the paper with Conclusions (Section
8).

##  2 Background and Related Work

Here we outline the security challenges faced by smart device owners, then
turn to various lines of research on security advice.

###  2.1 IoT threat landscape

The adoption of IoT devices in homes is increasing. Using the definition of
Silverio-Fernández et al. [9], we define an IoT device as a context-aware
electronic device capable of performing autonomous computing and connecting to
other devices for data exchange, in either a wired or wireless manner.

Several issues with IoT devices have been identified, such as unauthorized
data collection, surveillance, and hacking [10, 4, 11, 12, 3, 13]. Once
attackers realized the potential to gain unauthorized access to such systems,
they started experimenting with different ways to exploit related
vulnerabilities. Numerous malicious scripts, tools, and malware emerged.
Malware families such as Mirai and Gafgyt [14, 15, 16, 17] are well-known.
Smart devices also have the potential to be co-opted within the home to
monitor and control domestic partners, as tech-abuse [18].

Numerous governments have declared baseline expectations and design principles
for IoT device security. Nevertheless, these efforts are not immediate, as
there are many manufacturers and product types, and a lack of reliable data on
the security practices of manufacturers [16].

###  2.2 Advice as a prompt to take action

The security of consumer devices will continue to require the involvement of
end users, for the foreseeable future [19, 6, 20, 21]. It has been observed
that end users have a relatively limited understanding, and potentially
erroneous or incomplete mental model, of smart devices and their associated
data-processing activities [4, 11, 22, 13].

Where device users may appear to ‘ignore’ security advice, their attitude may
actually be rational when factoring in their daily activities, and to what
extent manufacturers provide adequate user support [23, 24, 12, 25, 26]. For
example, prior to being prompted, only around half of the respondents in a
study by Emami et al. [27] expressed privacy or security concerns; this number
increased to almost all respondents once prompted about these topics. This
suggests that privacy and security could be latent concerns for users and must
be prompted in an appropriate way, ‘from outside’. Many end users are
interested in protecting their devices, but struggle due to lack of knowledge
about security risks and protection methods [28, 27].

According to Haney et al. [11], end users perceive they have some
responsibility in securing their IoT devices, but to do so successfully
requires collaboration with manufacturers and governments/regulatory
organizations [29]. This all suggests that users’ success in securing their
smart devices is to some extent reliant on the efforts of other stakeholders
in the wider consumer device ecosystem. The adoption of security practices can
be strongly encouraged by media, family, and peers offering cybersecurity
advice [30, 31], especially when unfavorable security situations are depicted
with relatable people [32, 33, 25]. Nonetheless, confronted with the overload
of advice [6] and limits to user time and effort, end users may leave their
devices in a less-than-secure state [34, 12, 22]. People have limited time to
devote to security depending on the perceived security benefit of applying a
piece of advice [24, 25, 2]. Other reasons for users to reject cybersecurity
advice range from excessive marketing material, advice not seeming to be
reliable, lack of trust in the advice source, or because the user has not yet
had a negative experience [29, 35].

###  2.3 Quality of consumer advice

The quality and effects of the formulation of cybersecurity advice have been
explored in several works. As Reeder et al. [1] point out, varying computing
contexts make it challenging to derive helpful general advice. There is
widespread cybersecurity advice of which most is found online, resulting in an
overload of disorganized advice [6]. Some pages give a sequential list of
steps, assuming that the reader has a certain level of technical skill to
determine how to perform them. In contrast, pages may otherwise contain so
much advice that it could become overwhelming, making it difficult to know
where to get started.

As a response to this problem, Ion et al. [12] outline characteristics of
sound security advice while Turner et al. [2] more specifically focus on IoT
devices and consider the quality of advice, how well it is written, and the
extent to which it can reach end users. In line with this, [1] states that
’general advice’ should be: Effective, Actionable, Consistent, and Concise.
There, conciseness is discussed regarding the number of pieces of advice a
person needs. The applicability of cybersecurity advice, however, is not taken
into consideration. This issue is touched upon in only a limited sense [23, 4,
11], noting a lack of available information about the security features of IoT
devices, and the provision of advice on cyber hygiene by manufacturers
(concluding that manufacturers do not provide a comprehensive manual or
support page).

Smart home device users have also expressed dissatisfaction with the lack of
support [36], struggling to find useful information on either the manual or
support page of a device manufacturer to improve the security of their device.
Regarding the applicability of advice for consumer IoT devices, [36]
demonstrates the impact of uncertainty, with end users checking for a password
on their IoT device; if they cannot find it, they still do not know if it
exists. As demonstrated by Reeder et al. [1], good advice is not a universal
truth as it is highly contextual; some pieces of advice may be effective for
some people with particular computing environments, but not for others [36,
34, 29, 6, 1, 37]. In conclusion, there is an over-production of advice,
diversity of smart home devices, and expectation for smart home users to take
action; there is a gap in supporting qualifying of which advice applies to
which specific devices (and in what way) and the extent to which users are
supported to determine what they can do to secure their smart devices.

##  3 Public-level Advice – Methodology

This section addresses our first research question, ‘what is the baseline of
convergent advice to users for securing consumer IoT devices?’. We consider
governments and public bodies as acting to provide broadly applicable yet
workable advice to the public.

###  3.1 Data selection

Using the top 10 of the Network Readiness Index (NRI) of 2021, we selected
countries that offer specific IoT advice to citizens [8]. These are the United
Kingdom, the United States, and the Netherlands (NL) (Dutch-language text is
translated by the authors). We selected these three countries as
representative of public-facing advice about IoT devices at nation-scale.
Countries were also selected based on the authors having collective knowledge
of the IoT and regulatory landscape of those countries. Per country, we
explored the information provided for IoT devices and documented each distinct
piece of cybersecurity advice. The UK and the Netherlands define IoT devices
as any device that can be connected to the Internet. The US has an even
broader definition, and defines an IoT device as:

> US - “Any object or device that sends and receives data automatically
> through the Internet. This rapidly expanding set of “things” includes tags
> (also known as labels or chips that automatically track objects), sensors,
> and devices that interact with people and share information machine to
> machine. [38].”

###  3.2 Data analysis

A ’codebook’-style thematic analysis [39] was conducted to compare the pieces
of advice with each other. Pieces of advice were discussed at regular codebook
meetings within the author team, to identify overlaps and discuss unclear
cases. An inductive approach was applied in which, per country, all pieces of
advice that were given on their governmental website regarding securing IoT
devices were identified. In the next stage, the gathered pieces of advice per
country were considered side-by-side by the first author. Where a sufficient
overlap was identified between pieces of advice of different governments,
these were clustered together as one convergent piece of advice. This process
was discussed in iterations with the other authors. For example, the following
three pieces of advice were clustered together to formulate the convergent
advice ”Change default password(s) to new strong password(s)”:

UK - “Consider the factory set password a placeholder. You should immediately
change it the moment you start using the new device. Otherwise, anyone who
previously had access to the factory settings password can access your
device.” ”You should make your passwords as un-guessable as possible for an
outsider [40].”

US - “Some Internet-enabled devices are configured with default passwords to
simplify setup. These default passwords are easily found online, so they don’t
provide any protection. Choose strong passwords to help secure your device
[38].”

NL - “Wijzig het standaardwachtwoord en stel een sterk wachtwoord in
[41].”(_”Change the default password and set up a strong password”_)

##  4 Public-level Advice – Results

Similar to the findings of [1] regarding online security advice, for consumer
IoT devices we found a wide spread of security advice. A total of 30 pieces of
security advice were uncovered (Table 1).

Advice | UK | US | NL
---|---|---|---
DEFAULT CREDENTIALS |  |  |
Change default to strong password | ✓ | ✓ | ✓
Do not reuse passwords | ✓ | ✓ | ✓
Use a password manager | ✓ | ✓ | ✓
Change default username |  | ✓ |
ROUTER |  |  |
Disable UPnP | ✓ | ✓ | ✓
Change default password router |  | ✓ | ✓
Don’t use WPS | ✓ | ✓ |
Disable remote management |  | ✓ | ✓
Change SSID a.k.a. network name |  | ✓ |
Install a network firewall |  | ✓ |
Reduce wireless signal strength |  | ✓ |
Turn off network when not in use |  | ✓ |
Activate WPA2 |  |  | ✓
Monitor for unknown device connections |  | ✓ |
Use the router provided by the ISP |  |  | ✓
Use router intended for small businesses | ✓ |  |
UPDATES |  |  |
Install updates | ✓ | ✓ | ✓
Activate automated updates | ✓ | ✓ | ✓
NETWORK CONNECTIVITY |  |  |
Only connect device to internet if necessary | ✓ | ✓ | ✓
Use an Ethernet cable instead of Wi-Fi |  |  | ✓
OTHER |  |  |
Create unique accounts for each user |  | ✓ |
Use multifactor authentication | ✓ | ✓ |
Enable encryption features | ✓ | ✓ |
Switch off sensors if not necessary | ✓ |  | ✓
Switch device off and not leave in standby |  |  | ✓
Download apps from built-in app. stores |  | ✓ |
Use antivirus software |  | ✓ |
Install a firewall for IoT devices |  | ✓ |
Regularly back up your data |  | ✓ |
Remove unnecessary services and software |  | ✓ |
Table 1: Governmental Advice Comparison - The above overview shows each piece
of cybersecurity advice found per country. These pieces were grouped together
when various government recommendations were deemed to sufficiently overlap.
This resulted in certain pieces of advice receiving more than one checkmark.

Various definitions for passwords, updates, and consequences of applying these
were observed. For example, within the governmental advice, there were
differences between countries in whether it was declared that a device could
have one, or more, ‘default’ passwords. One explanation for this is that each
country emphasizes different security aspects. The advice of the US, for
example, focuses on securing the router. In contrast, the Dutch advice
emphasizes the installation of updates through their campaign ”Doe je updates”
(_”Do your updates”_). Despite these different focus points, seven pieces of
convergent advice were uncovered.

We focused on advice about securing individual IoT devices. Within this we
note that although the router serves as a gatekeeper for the network, we do
not consider it an IoT device. This focus resulted in putting to one side any
converging advice that is not directly applicable to devices, and instead
applies to the broader home network, for example, using a password manager and
disabling use of the Universal Plug and Play (UPnP) protocol on the router.
These pieces of advice can be considered additional measures users can take to
secure their IoT devices, which play a vital role in improving the level of
security of the IoT ecosystem, but are outside the scope of this research.
Because we did not consider advice that obstructed actual use of the device,
the advice to only connect the device to the Internet if necessary was also
excluded as that defeats the purpose of using the device securely. As a
result, four converging pieces of public-level advice remained:

  1. 1.

Change the default password to a new strong password.

  2. 2.

Use different passwords for different devices

  3. 3.

Install updates.

  4. 4.

Activate automated updates/set a periodic reminder in your calendar.

These pieces of advice were the most widely communicated top-down advice for
each country and will be referred to as top pieces of advice for the remainder
of this paper. An overview of the source text used for each piece of advice
can be found in the Appendix. The four general pieces of convergent advice, or
themes, are: to change the default password to a new strong password, to use
different passwords for different devices, install updates, and activate
automated updates. These top pieces of advice also align with what security
experts choose as the most essential advice, as identified in existing IoT
research [23] (and e.g., signposted in recent US government initiatives for
smart home device security [42]), but also in general cybersecurity [6, 1].
This further implies that such advice is commonly held, and would be what
reaches consumers from various community or expert channels (not just public-
level advice).

The public-level advice on the websites of the US and the UK give a summary of
the cybersecurity advice they deem essential on one dedicated page [38, 40].
In these pages, words are highlighted that, when clicked, redirect users to
webpages that give more specific information about a particular subject. These
forwarded pages contain general information, for example, on how to set a
strong password aimed at computing devices and online services.

The primary goal of the public-level advice of the selected countries is to
make devices more resilient against outside threats. The threats that are
mentioned are attackers, botnets, or cyber-criminals that try to break into
the device with the goal to retrieve personal data, cause damage to the
device, or use the device to attack other devices (in the case of a botnet
attack). The UK advice also warns about risks of the misuse of personal
information by the manufacturer of the device. In upcoming sections, we will
further detail how these countries frame the different pieces of advice, and
explore what this means for efforts to apply the device.

###  4.1 Changing default password

When looking at the piece of advice to change the default credentials, the
selected countries generally refer to changing the default password(s), as
soon as possible. Only the US also recommends changing the default username.
Although all the selected countries use the word _default_ to refer to the
password they deem important to be changed, the UK uses this term
interchangeably with the words ‘factory set password’ across separate pages.
The latter wording more strongly emphasizes that the advice refers to
credentials set during device production. The advice of the US also suggests
to consider default passwords as already public since they can be found
online. In sum, users are advised to change a password on a device
immediately, thereby also inferring that there is a password for the device
itself. As the main objective of top pieces of advice is to make devices more
resilient against outside threats, this seems to be a password that enables
access over a network.

What is striking is that the advice of the UK and NL seems to assume that
there is one default password per device that needs to be changed, while the
US speaks of multiple passwords per device. Similar differences can be
observed within the scientific literature where some works (e.g., [23, 14])
speak in terms of _the one_ default password, while others (e.g., [43, 4, 16])
more generally speak of default passwords. These interpretations suggest that
each device has _at the least_ one set of default credentials that can be
changed with little clarity as to how to be sure that a password is the one
relating to network access and not another one.

####  4.1.1 Setting strong password

The second piece of advice is to change the default password to a strong
password. All selected countries consider a password _strong_ if it contains
upper- and lowercase letters, digits, and special characters and does not
include personal information. However, the minimal length differs, varying
from a minimum of 8 to 12 characters. Some advice, such as the UK and the US,
discourages dictionary words and encourages random strings of letters and
digits. In contrast, top pieces of NL advice include examples of sentences
with dictionary words111Parallel advice in the UK also follows this approach,
as at https://www.ncsc.gov.uk/blog-post/three-random-words-or-thinkrandom-0.
The latter highlights that there may also be differences in advice available
within countries.

###  4.2 Using different passwords

The reuse of passwords is strongly discouraged by all countries, emphasizing
the importance of using ‘unique’ passwords for devices. While the US frames
this in terms of what users should not do, stating not to reuse passwords, the
UK and NL emphasize actions that a user should follow: use different passwords
for different devices. When changing an existing password, the US and NL
directly state to set a strong and unique password, while the UK speaks of
creating an ’un-guessable password for an outsider.’

###  4.3 Installing updates

As for installing updates, the security advice of all countries uses an
assertive tone, urging to ‘apply’ or ‘carry out’ (firmware/software) updates
or patches as soon as they are available. When the word ‘patches’ is used, it
is always explained that these refer to updates. In the three countries, the
advice implies that the primary goal of an update is to improve the security
functionality of the device, to protect against outside threats. The UK, for
example, notes:

> ”Firmware updates allow manufacturers to install software patches in case a
> security vulnerability is detected.”

Taken together, this resulted in the theme ‘installing updates to improve the
security of IoT devices’.

Though updates might include security elements that improve a device’s
security, this is not guaranteed as an update could potentially only – or also
– include enhancements to features, such as modifying the interface or menus.

###  4.4 Enabling auto-updates

We generally find that users are instructed to check if a device offers the
option to automatically update and manually check for updates if this is not
the case. Regarding automatic update functionality, wording includes auto-
update features, automatic updates, automatic updating, and applying updates
automatically. The UK and NL specifically instruct users to enable them, while
the US is less direct and states to take advantage of automatic options when
available. In the absence of auto-update capability, the US and NL
governmental top pieces of advice recommend that end users periodically check
for updates.

The advice of the UK appears to assume that devices that lack an auto-update
feature can be configured to notify users of new updates. Only the NL advice
mentions and emphasizes a device’s companion app as a way to install updates
and specifies where and how to look for updates. Within the NL advice, it is
recommended, for example, to first consult the manual to check if the device
is supported with updates (and supports walking through checks for enabling
automatic updates through an accompanying app).

Where devices do not support automatic updates, it is recommended to check the
settings of the companion app for update notifications, and if these are not
there, to check the manufacturer’s website. When details concerning update
support are lacking, it is recommended to contact the manufacturer directly.
Although the US advice covers ”How do I set up automatic updates,” the
accompanying information similarly relies on users investigating features,
such as ”Turn on and confirm automatic updates” and ”How you turn on automatic
updates can differ depending on the software and the device” without going
into more detail.

##  5 Device Materials – Methodology

Here we explore our second research question, ‘How does the identified
baseline of convergent advice align with the content of instruction manuals
and other related materials for the selected consumer IoT devices (as signals,
or prompts) as provided – or not – by manufacturers?’ We draw in the ‘top
pieces of advice’ from the advice provided by public-level bodies in the
previous section.

###  5.1 Data selection - devices and materials

Figure 1: The examination methods utilized in this paper are shown in the
above diagram. The two flow charts illustrate the analysis process for each
source consulted for each IoT device. Keywords were used for the loop in the
first chart and search queries for the second chart.

In this stage, the goal is to test the presumption that the top pieces of
advice align with available IoT device features. We employ a method that
utilizes information sources that end users can access, in place of a physical
inspection of each actual device.

We chose to rely on device documentation and Internet searches, rather than
the costly and non-scalable alternative of directly purchasing each and every
device, because IoT devices continue to proliferate into evermore product
types and designs. As a field, we need to explore approaches that allow us to
move with this proliferation. Requiring physical access to a device for
analysis would severely restrict research and pose problems of generalization.

Beside this scaling problem, approaches based on physical devices have their
own drawbacks. Cognitive walkthroughs, for example, where the researcher steps
through device features, have issues with ecological/external validity [44] in
terms of asserting to represent the user journey [45]. Our work targets a
middle-ground, or precursor step, to identify signals that qualify public-
level advice as applicable to specific devices. Our approach includes third-
party sources via YouTube and web search – YouTube and top search content
often responds to user needs (for missing information about devices) or
relates to actual users documenting their experiences of device use (filling
in gaps in support). We aim to strike a balance, by systematically exploring
resources that users would have access to, bridging the top pieces of advice
and device functionality.

Because the emphasis of our study is on advice to consumers, we restricted our
choice of IoT devices to those utilized within a domestic setting. We selected
40 popular IoT devices across five categories, to ensure a diverse selection
of commonly used IoT devices: smart entertainment, smart health, smart
security, smart assistants, and smart home appliances. The release dates of
the devices ranged from 2015 to 2021. Per category, we selected the devices
from brands that were sold in all three countries, and listed in the top lists
of frequently purchased devices per device category on the websites of popular
retailer companies: Amazon, CoolBlue, and Bol.com, since these will have most
of the market share. Although we examined websites available in the
Netherlands, the devices we cataloged are produced by international brands,
and are available in many countries. To generate an overview of known device
functionality, we first consulted the manual and quick guide if available (not
all devices had a ’quick guide’, for example). We also consulted the website
of the manufacturer and their YouTube channel (if available).

We do not assume that all features are documented in the provided materials –
we also used a browser search for third-party search results (specifically the
Google search engine) and YouTube, as manufacturer materials may not include
all pertinent information about the functionality of a device. These third-
party sources consisted of blogs, vlogs, forums, retailer- and news-websites,
and YouTube channels. For the online sources, we used the following search
queries to find more information about default passwords and how to change
them, drawn from Section 4:

  1. 1.

$DEVICE_NAME default password

  2. 2.

$DEVICE_NAME factory set password

  3. 3.

$DEVICE_NAME changing the default password

  4. 4.

$DEVICE_NAME changing the factory set password

Here, $DEVICE_NAME is replaced by one of the 40 devices of which an overview
can be found in Table 6. To find more information about the extent to which
devices are supported by updates, we used the following search queries (for
search (2), this included where the search engine resolved the term to
‘automatic’):

  1. 1.

$DEVICE_NAME updates

  2. 2.

$DEVICE_NAME auto updates

  3. 3.

$DEVICE_NAME security updates

###  5.2 Data collection – accompanying material and online platforms

Data was gathered between December 2021 and the end of March 2022. We searched
for videos on YouTube, the search results in the form of webpages through
Google browser search, and the website of each manufacturer, for which the
first five results were checked for each search query when possible. In the
case of using the search engine on the manufacturer’s webpage (if there was
one), rarely more than one result appeared per search query. Interestingly, on
many occasions, more search results showed up for manufacturer websites
through a Google browser search than when directly using the search engine on
the manufacturer’s website. Accounting for overlapping results, the total
number of unique search results on Google was 746, and 626 on YouTube. 212 of
the search results on Google and 76 on YouTube were websites and videos
created by the manufacturers directly. The remainder contained websites and
YouTube channels from third parties.

Within the online manuals, quick guides, written transcripts of YouTube
videos, and webpages, we searched for the existence of the keywords ”password”
and ”update.” When these keywords were found in the text, it was read in order
to understand the context and significance around these keywords. See Figure 1
for an overview of the analysis process. One author followed the same approach
of codebook-style thematic analysis [39] as for the resources of the top
pieces of advice, involving coding and regular discussion, toward determining
whether resource content supported one of the four pieces of advice. For
codebook-style thematic analysis one coder is sufficient [39, 46].

##  6 Device Materials – Results

We first checked which resources were provided by the manufacturer, finding
that all devices in our search provide some form of documentation, such as a
manual (31 devices), quick guide (15), or both (6) (see Table 2). The texts
were first examined using the terms _default password_ or _factory-set
password_ as based on the top pieces of advice, but in none of the cases were
these terms used.

|  Quick Guide |  Manual |  Manufacturer Website Pages |  YouTube Manufacturer Channel |  YouTube Third Parties |  Google WP Manufacturer Results |  Google Third Parties
---|---|---|---|---|---|---|---
INFO DP APPLICABLE |  |  |  |  |  |  |
Changing DP to strong DP | 0 (0) | 0 (0) | 0 (0) | 0 (0) | 0 (0) | 0 (0) | 0 (0)
INFO PWD REUSE |  |  |  |  |  |  |
Discourage reuse PWDs | 0 (0) | 0 (0) | 0 (0) | 1 (1) | 0 (0) | 0 (0) | 0 (0)
INFO DP NOT APPLICABLE |  |  |  |  |  |
Changing to strong PWD | 0 (0) | 0 (0) | 0 (0) | 0 (0) | 0 (0) | 0 (0) | 0 (0)
Changing DP | 0 (0) | 0 (0) | 0 (0) | 0 (0) | 2 (2) | 4 (5) | 7 (11)
Changing/setting a PWD | 2 (2) | 2 (2) | 7 (7) | 2 (4) | 15 (32) | 8 (13) | 11 (12)
Mentioning DP | 0 (0) | 0 (0) | 4 (4) | 0 (0) | 1 (1) | 1 (1) | 2 (3)
Mentioning PWD | 0 (0) | 10 (10) | 14 (15) | 5 (6) | 20 (44) | 15 (17) | 29 (68)
NO INFO PWDs |  |  |  |  |  |  |
No info on PWD | 13 (13) | 19 (19) | 0 (0) | 17 (32) | 37 (203) | 28 (57) | 36 (150)
Info diff. device/PNF | 0 (0) | 0 (0) | 40 (136) | 1 (5) | 11 (18) | 4 (5) | 12 (22)
TOTAL UNIQUE SOURCES | 15 (15) | 31 (31) | 40 (162) | 20 (48) | 40 (300) | 38 (98) | 40 (266)
Table 2: Default Password (DP) Results Overview - The table provides an
overview of the number of unique devices (max. 40) that are accompanied by
informative material on passwords (PWD) per source category. The number of
sources is listed in parentheses. The rows under “INFO DP APPLICABLE” and
“INFO PWD REUSE” indicate the number of sources that have enough information
to follow advice 1 and 2, which are to change default passwords to strong
passwords and discourage password reuse. No sources for any device support the
first piece of advice, and only one source (from the manufacturer’s YouTube
channel) for one device supports the second. The rows under “INFO DP NOT
APPLICABLE” and ”NO INFO PWDs” show sources that do not have enough
information to follow the advice and are included to give insight into the
availability of information on (default) passwords and the frequency of lack
of information to apply the pieces of advice. For example, none of the quick
guides for the 40 devices mention default passwords at all.

Interestingly, it was not uncommon to find webpages on manufacturer websites
via the Google search engine (results which did not appear when using the
search engine on the manufacturer website directly). A supporting overview of
device coverage of advice is in Appendix, Table 6.

###  6.1 Support for changing default password

The term _default password_ was only used for four devices on manufacturers’
websites when using their search engine (Table 2, third column, ‘Mentioning
DP’). Third-party results, such as YouTube channels and Google search results
which are not the manufacturer, tended to include more information on default
passwords, although still for the minority of devices (10)222Although Table 2
shows 12 devices for third-party results that contain information about
(changing) default passwords, two of these contained information on YouTube
and Google which brings the total of devices that refer to default passwords
to 10.

####  6.1.1 Potential for many default passwords

The phrase _factory-set password_ did not appear in our examination, and the
results that did appear primarily included information on factory-resetting
devices. When a default password was mentioned, it did also refer to the
default password on the Wi-Fi router, as was the case for e.g., Ring doorbell
(Smart Security) and Bose smart speaker (Smart Assistants). Overall, Wi-Fi
routers played a vital role within the provided resources, as the Wi-Fi
password was the most mentioned password in our dataset. The primary goal of
the documentation, when mentioned, was to connect the device to the Internet
rather than securing the network. There are then challenges in determining if
the default password for securing use of a device on the network is regarded
as even being on the device itself.

####  6.1.2 Qualifying a password as the default password

For none of the devices that mention a default password, more than one default
password is mentioned. This finding did not change when including the YouTube
and Google results from third parties. Even with the sources mentioning a
default password, it was still not possible to qualify the advice. It was, for
example, not clear if it was possible to set a strong password for devices
other than those that only accept numerical passwords. Furthermore, for the
sources where the term ‘default password’ was used, the instructions on how to
change these were not always included, as shown in Table 2 in categories
referring to “Info DP”. In these cases, the information was mostly limited to
providing information as to what device the default password is for, when
someone forgets the password, or has had to reset the device. Mostly, when a
default password was mentioned – and in cases where no further instruction on
how to change it was provided – it referred to a password on the device
without declaring related security functions or benefits.

|  Quick Guide |  Manual |  Manufacturer Website Pages |  YouTube Manufacturer Channel |  YouTube Third Parties |  Google WP Manufacturer Results |  Google Third Parties
---|---|---|---|---|---|---|---
INFO UPDATES APPLICABLE
Manually installing updates | 1 (1) | 6 (6) | 4 (6) | 5 (5) | 16 (31) | 8 (9) | 18 (21)
Enabling/forced auto-updates | 0 (0) | 6 (6) | 5 (6) | 1 (1) | 9 (16) | 12 (17) | 9 (28)
INFO UPDATES NOT APPLICABLE
Info about auto-updates | 0 (0) | 1 (1) | 2 (2) | 0 (0) | 3 (4) | 8 (13) | 16 (20)
Contains info about updates | 1 (1) | 1 (1) | 6 (7) | 1 (1) | 21 (45) | 13 (26) | 34 (83)
NO INFO UPDATES |  |  |  |  |  |  |
No info about updates | 13 (13) | 17 (17) | 0 (0) | 18 (31) | 38 (207) | 26 (48) | 30 (109)
Info diff. device/PNF | 0 (0) | 0 (0) | 28 (33) | 1 (1) | 11 (26) | 4 (7) | 11 (26)
TOTAL UNIQUE SOURCES | 15 (15) | 31 (31) | 40 (54) | 21 (39) | 40 (329) | 38 (120) | 40 (287)
Table 3: (Auto-)Update Results Overview - The table provides an overview of
the number of unique devices (max. 40) that are accompanied by informative
material or not on (auto) updates per source category. The number of sources
is listed between parentheses. The rows under “INFO UPDATES APPLICABLE”
indicate the number of sources that have enough information to follow advice 3
and 4, which are to manually install updates and the enabling of auto-updates.
It’s worth noting that all devices have at least some sources that mention
updates, but that the majority of sources do not provide information on how to
install or enable (auto)updates. The rows under “INFO UPDATES NOT APPLICABLE”
and “NO INFO UPDATES” show sources that do not have enough information to
follow the advice and give insight into the availability of information on
(auto) updates and the frequency of lack of information to apply the pieces of
advice.

####  6.1.3 Having multiple default passwords for securing a device

Our analysis shows that a great variety of passwords can be changed, which are
mostly not referred to as the ’default’ password.

An encouraging example of manufacturers recognizing this challenge is the
Reolink doorbell (Smart Security), which dedicates a webpage to describing the
distinctions between the Password for the Reolink App, the Reolink Client, and
the Reolink Cameras (Smart Security). The password(s) that can be changed on
devices may still represent one or several default passwords even while the
phrase ”default password” is missing. In these cases, any password on the
device could or could not be a default password, making it difficult to
determine whether it is possible to change the default password as advised, as
shown by the Reolink example. On top of that, even when the wording ’default
password’ is used, it does not necessarily provide security benefits against
outside threats, like in the cases where default passwords refer to a 4-digit
parental code (as for two smart TVs, the Samsung UE49MU8000 and the LG UHD TV
43UP80 (Smart Entertainment).

As another example, the default password of two smart TVs only allowed for
setting a 4-digit code. Even if it had been possible to set a strong password
in these instances, it still would not protect end users from outside threats
that were described in the top pieces of advice sources. This is because these
kinds of passwords, as a class of parental controls, only protect against the
change of TV settings by unauthorized members within the home, and are not
associated with the root control of the device (that could potentially be
exploited over the network).

####  6.1.4 A difference between strong and stronger passwords

If the existing password did not meet the recommendations for a strong
password, the advice to set a strong password can provide security benefits,
but only if the device supports these requirements. However, as shown in Table
2, we did not find a single resource confirming that it is possible to set a
password that complied with the requirements of the top pieces of advice for
setting a strong password. Sources providing information on setting or
changing a password, not limited to digits only, indicate a requirement of
using a minimum number of characters and allowing for letters, and digits to
be set.

For eight devices it was mentioned _how_ to change the default password, see
row “Changing DP” in Table 2. However, this did not mean it could be changed
to a password that contained upper-and lowercase letters, digits, and special
characters (as often advised, subsubsection 4.1.1).

For the NVIDIA media player (Smart Entertainment), an explanation of how to
change the default password was found, but it was not made clear if it was
possible to apply the criteria of the top pieces of advice for setting a
strong password. This marks the difference between being able to make a
password sufficiently strong, or as strong as the device allows it to be.

In some cases, it is mentioned to use upper- and lower-case letters, but never
in combination with the use of special characters. The latter is even actively
discouraged when creating a Govee smart light (Smart Entertainment) user
account. They note, “Passwords should be 8–20 characters using both letters
and numbers only. Do not include special characters or symbols.”

The Anova smart oven (Smart Home Appliances) and Withings smart scale (Smart
Health) require lowering the router’s security as these can only connect to it
if the router’s password lacks special characters. It can be concerning that
all devices seem to allow, and some even force, setting a password that does
not meet the requirements of the top pieces of advice. This permission for the
use of weak passwords is, unfortunately, a finding that is not uncommon (see
also [47]).

###  6.2 Support for using unique passwords

Regarding the use of unique passwords, only in the case of the Reolink
doorbell (Smart Security) is there one YouTube video from the official channel
of Reolink where the reuse of passwords is actively discouraged, which shows
that the theme where passwords are understood as a way to protect against
unauthorized access is shared to some extent by manufacturers, see Table 2.

####  6.2.1 Attempt to apply password advice scenarios

Taken together, the range of advice we observed in relation to changing the
default password to a new strong password could, in practice, translate to the
following scenarios:

  1. 1.

The end user changes a default password with security benefits against outside
threats. Of the 6 manufacturers where a default password was mentioned in
their material, 3 could potentially offer security benefits to outside
threats, however it was not clear if these could be changed, let alone to a
strong password.

  2. 2.

The user changes a password called the _default password_ by the manufacturer
that does not add any security benefits regarding online threats, which was
the case for 2 manufacturers (‘default password’ was a parental PIN code).

  3. 3.

There is no information about a default password, which was the case for 30
devices, so the end user does nothing.

  4. 4.

There is no information about a default password, so the end user changes a
password that they can find for the device, that does not confer security
benefits to outside threats. This would be possible, especially if the device
has multiple accounts associated with it which each have a password or PIN,
where potentially only one confers the security benefits described in the top
pieces of advice.

  5. 5.

There is no information about a default password, as was the case for 75% of
the analyzed sources; the end user changes a password that does have security
benefits.

  6. 6.

There is no information about a default password, so the user changes a
password for another device, such as changing the Wi-Fi password on the
router. At best, this could inadvertently result in a security benefit.

  7. 7.

There is no information about a default password, but the end user searches
for one anyway under the assumption that there is one. This may leave the user
in an ambiguous state, either satisfied that they have checked, or concerned
that they have not been able to secure the device.

Scenario 2 above could potentially lead to end users feeling they have applied
the advice while expecting additional security benefits, even though this is
not the case, leaving them feeling more secure than they are. Alternatively,
in Scenarios 3-6, where end users cannot be sure that the advice applies to
their device because the information is missing, it is much less assured that
the intended security benefit will happen, appearing more like a ‘folk’
security behaviour [48]. The opposite is also possible, where end users can
feel less secure when not able to apply advocated advice. There is existing
evidence of the potential for users to be unsure of the security features and
benefits provided by their IoT devices [3].

|  Quick Guide |  Manual |  Manufacturer Website Pages |  YouTube Manufacturer Channel |  YouTube Third Parties |  Google WP Manufacturer Results |  Google Third Parties
---|---|---|---|---|---|---|---
Smart Entertainment | 0(0) | 4(4) | 3(2) | 2(2) | 16(5) | 4(3) | 6(5)
Smart Health | 1(1) | 3(3) | 1(1) | 1(1) | 7(2) | 3(3) | 6(4)
Smart Security | 0(0) | 2 (2) | 2(2) | 1(1) | 9(4) | 6(6) | 7(4)
Smart Assistants | 0(0) | 1(1) | 6(4) | 1(1) | 14(7) | 11(6) | 27(7)
Smart Home Appliances | 0(0) | 2(2) | 0(0) | 1(1) | 1(1) | 2(1) | 3(3)
TOTAL UNIQUE SOURCES | 1(1) | 12(12) | 12(9) | 6(6) | 47(19) | 26(19) | 49(23)
Table 4: Applicable (Auto-)Update support per IoT device category - The above
table represents the distribution of sources per device category that support
the applicability of the advice to install or enable auto-updates. The number
of unique devices (max. 40) to which these sources apply is listed between
parentheses.

###  6.3 Support for installing updates

When checking the quick guides of devices, only the Garmin smart scale (Smart
Health) and Wink smart home hub (Smart Assistants) mentioned update support.
The first showed what the icon looks like when the device is installing an
update and when an update was successful or failed, while the other briefly
described how to update the app. Although still low, consulting the manual
offered a higher chance of finding information about the provision of updates,
as this was provided for 15 devices. Including manufacturers’ webpages and
YouTube channels resulted in a stark increase to 34 devices that offer update-
support, which grew further to all devices when including non-manufacturer
webpages and YouTube channels. However, this information wasn’t always easy to
find, as seen in Tables 3 and 5. Similar to Table 2, most device materials in
Table 3 were not aligned with the top pieces of advice demonstrating that
features existed for devices but were not adequately documented.

There were significant differences between device categories regarding the
amount of sufficient information provided. It was, for example, hard to find
information on updates for smart home appliances if compared to smart
assistants; see Table 4. In cases where update information was found, it was
not always sufficient to apply the advice to manually install updates. In
other cases, information on manually installing updates was missing or not
intended for the user to do, as with the LG smart refrigerator (Smart
Appliances), where a YouTube video showed that only LG Authorized Service
could update the software.

The purpose of an update is broader than is the case for a password and
primarily serve to repair, improve, or add functionalities. The general
assumption in the advice is that security issues are fixed through updates. We
then also checked for the mention of security updates. Similar to [23], 11% of
the results mentioned security updates, usually limited to disclosing a patch
or update applied.

###  6.4 Support for enabling auto-updates

For devices where we found information on security updates/security patches
(as a subset of our sample, as in Table 5), information about auto-updates was
also provided in half of these cases. Most manufacturers encourage enabling
automatic updates with the promise that they will improve the device’s
performance. Only for the Samsung smartwatch (Smart Health), it was clearly
stated that automatic update support is not provided (which would help to
reduce uncertainty, a noted use concern elsewhere [49]). The promise to make
the device more secure is also mentioned but less frequently. It shows that
manufacturers, leading to the development of the fourth theme, mostly present
updates as a way to improve the functionality and usability of IoT devices.
This mirrors findings elsewhere [4], wherein users appear not to relate device
updates to security functionality.

|  Manual-updates only |  Auto-updates only |  Manual & auto-updates |  Not provided
---|---|---|---|---
1\. All sources make mention updates. | 0 | 0 | 4 | 0
2\. More than half of the sources make mention of updates. | 2 | 3 | 10 | 0
3\. Half of the sources make mention of updates. | 5 | 2 | 5 | 0
4\. Less than half of the sources make mention of updates. | 1 | 0 | 1 | 0
5\. Only one of the sources makes mention of updates. | 5 | 1 | 0 | 1
TOTAL DEVICES | 13 | 6 | 20 | 1
Table 5: (Auto-)Update Effort Score - For each source it is checked if and
what information was provided regarding update support using the
manufacturers’ and non-manufacturers’ sources for each device. All devices
contain at least one source that provides information regarding update
support; however, for one device, the kind of update support, whether manual,
automatic, or both, was not provided.

The top pieces of advice imply that users need to enable automatic updates
manually. However, 12 of the 16 devices seem to update themselves by default
when connected to the internet (the remaining four mention that it can be
switched on). This automation translates the advice from enabling updates to
declaring no need for users to take action (which could be just as useful to
know). This minimization of end user involvement connects to the ethical
considerations described by van Steen [50], as a decision is made by the
manufacturer that is not always (clearly) communicated to users and restricts
freedom to make their own choices.

For devices where it is clear that updates are separate for the device and
companion app, this does not imply they both support automatic updates by
default. The Google smart doorbell (Smart Security), for example, updates
automatically by default, whereas the accompanying app does not.

##  7 Discussion

Returning to our first research question, we identified four themes of
converging public-level advice for consumer IoT devices: change default
passwords; enable automated updates; and install (manual) updates. Within our
limited sample, the terminology was inconsistent across advice sources, but
with overlap on some points.

When considering our second question and the content of manufacturer
materials, the current way that pieces of general advice are formulated may
seem reasonable at first glance, but does not connect with the features
indicated by the manufacturer-provided information for devices. This requires
the user to infer there is a connection, where relying on some existing
knowledge of terms and what they mean has its shortcomings [1]. For example,
for some devices not every credential could be used to log into the device via
the network. This misses opportunities to leverage prompts [51] during device
configuration to increase security.

Update features existed for all examined devices (as determined in our broader
search of third-party sources), but were barely documented by manufacturers,
with an 11% likelihood of discovering this information inside our dataset when
only focusing on manufacturer-provided material. See Table 3. In device
materials, there is then a lack of explicit declaration of the existence (or
not) of security features.

Combining our two research questions, informing our aim of identifying basic
non-trivial advice for consumer IoT users to follow, the public-level advice
that we examined mostly could not be directly related to our set of selected
(popular) devices, meaning that it is not targeted, correct advice for
increasing the security of the device – features are often not there, not
confirmed, or not mentioned. Based on the sources analyzed, none of the
devices seem to support all four top pieces of advice at once. Device
materials rarely mentioned passwords, then relying on software/apps to provide
just-in-time prompts and signaling, for both the purpose and expectations for
password security, in the absence of explanation elsewhere.

Compounding these issues, terminology discrepancies also existed between the
top pieces of advice for passwords and device materials. For example, where
‘default’ passwords were mentioned in device materials, it could also refer to
the router/Wi-Fi password. Consequently, in many cases there is no direct
route from public-level advice to device materials to user actions.

###  7.1 Acknowledging the mismatch

Current advice bodies offer generic pieces of cybersecurity advice that,
despite the IoT environment being highly diverse, convey a sense that IoT
devices are alike. It is not that the advice loses detail because it is
generalized [1], but because it is selectively applicable; by not considering
the diversity of IoT devices, there is a lack of assurance and signaling
whether advice is relevant to specific devices before it is applied; this is
left to the user.

The inconsistent applicability of IoT advice to devices sits alongside it
appearing to be applicable where it is not. This results in an intervention
that works for devices where it applies, but has a different effect – or
potential unintended side-effects [52] – for devices which the advice does not
match to, in terms of whether those features exist for those devices. The
reliance on users to qualify IoT advice also brings unintended side effects
[53]. Government advice is not ‘wrong’ for compliant devices, but our analysis
suggests such devices are, by far, in the minority. proxy changes [52] could
mean that ‘some’ security was improved, e.g., a child-protection PIN as we saw
for some devices, but not security against network-based attacks.

The burden appears to be on the user to determine – to almost know in advance,
despite being assumed to be non-experts – which specific devices advice
applies to. Any users of the 40 devices in our study would need to somehow
know enough to decide – while lacking confirmatory information – that at least
two and often three of the top pieces of advice do not apply to their device
(as we found in our sample). For example, there may be multiple passwords or
not, of which one or more may be a ‘default’, relating to network
accessibility or not, with a capacity to be of variable attainable strength.
Recent research already highlights users being in a gulf between assuming
features do not exist and not being aware of them (as with smart device
updates [4, 5]), with advice not being specific enough to find the relevant
feature. Transparency in how features work can inform such user decisions
around smart device security features [54]. For instance, users whose devices
rely on manual updates may not know that they do [55], assuming instead that
update installation is automated. Prior work has also evidenced that users who
assume a device has a password may explore a range of sources and still not be
able to determine if a password feature exists [36].

There is a mismatch between current, diverse devices and a future-looking
regulatory regime (e.g., EU RED [56], and also e.g., the UK Code of Practice
for Consumer IoT [57]). Further, there is a lack of consideration for the
impact on user behaviors while generalized IoT advice and device features
remain out of alignment.

###  7.2 Limitations

Our choice to analyze support materials, rather than the physical devices
themselves, has certain pros and cons. A downside is that we did not verify
firsthand the features of the selected devices, or infer their features
through companion apps. Some features may be brought to the user’s attention
through just-in-time notifications on the companion app, for instance;
however, this would only emphasize the reliance on the user to realize the
relevance of any security prompts that exist, for lack of signaling from
support sources. There is a difference between a device having particular
features or not, and whether this is mentioned clearly in any associated
instruction materials. We chose to rely on device documentation and Internet
searches, rather than the costly and non-scalable alternative of directly
purchasing each and every device. Actual devices could be assessed by the
researcher, but related approaches such as cognitive walkthroughs have their
own issues with ecological validity [44, 45] and consistency in mapping device
features.

###  7.3 Recommendations

Based on our findings, we arrive at the following recommendations:

  * •

Researchers / Policymakers: surface your own mental models of device features
as well as those of users. Significant progress has been made in understanding
users’ perceptions of device functionality, for instance, in exploring the IoT
threat models perceived by users [3]. In our examination of public-level
advice and device materials, we found a disparity that top pieces of advice
appeared to assume that features exist, which we then did not find evidence of
for all of our selected devices (as in Table 2 and Table 3). This suggests a
generic model of a consumer IoT device, that has mostly escaped scrutiny, as
the kind of ‘common standard’ that, e.g., Blythe et al. [23] anticipate or
expect. It is important to document assumptions about the functionality of
devices that advice is being provided for and that users interact with, as
part of data-gathering. For instance, a user may struggle to find the default
password on a device not because of a lack of security knowledge, but because
the feature is not provided for their device(s) (as we found for many devices,
see Table 2). Steps in this direction are being made, e.g., documenting
participants’ devices [3, 13]. We must connect devices to specific responses
from users (and researcher assumptions of device capabilities), to understand
if users are struggling to use a feature because of its difficulty, or its
absence.

  * •

Policymakers: match advice to groups of devices. It may be possible to
identify distinct classes or groups of devices which are at the very least
more likely to have the features that advice refers to. This would act as a
shortcut that removes the need for users to determine if their device would
benefit from the advice. We found, as in Table 4, that e.g., information on
(automatic) update support was documented more for smart assistants than for
smart home appliances.

  * •

Manufacturers: declare the existence of security features. We posit that if a
security feature is included in a device, it should be made known that it
exists and how it works. As demonstrated by the results in Table 2, when a
default password was mentioned, information on how to change it was lacking.
Also, instructions for installing updates or setting auto-updates was not
always provided (Tables 3 and 5). The key is not to assume that users will
know about the existence of features (irrespective of knowing how to use
them). This relates to encouraging manufacturers to be more open about device
functionality [49], but ideally in a way that also relates conveying security
to customers (so they can both use and trust the device). Act first with an
assumption that the feature is new to the user and that concrete steps are
needed [58], rather than it being familiar [59, 49].

  * •

Policymakers / Manufacturers: consistent, approachable terminology. We found,
for example, that ‘default password’ had different meanings and
functionalities depending on the type of device (see subsection 4.1), and that
the advice offered by the studied countries differed in the number of
credentials a device may use. It would benefit the disparate activities of
researchers, policymakers, and manufacturers to have a narrower body of
terminology that links advice to device materials and features, as a two-stage
process of advising users. Prior work identifies this as a manufacturer
responsibility [60], where there is also a role for policymakers in ensuring
the applicability of advice terminology to device features.

##  8 Conclusion

We identified four pieces of convergent advice to users across three
representative countries (UK, US, and the Netherlands). No device was found to
which all four pieces of converging governmental advice could be applied,
suggesting that the advice was developed with an exemplar device in mind which
at best is not like the majority of devices on the consumer market. These
findings question the value of high-level advice campaigns by governments or
industry. Broadly speaking, future research will address these issues by
exploring the degree to which users can be provided with more specific
cybersecurity advice for their IoT device while also considering the
requirements this places on other stakeholders such as policymakers
maintaining advice and manufacturers of specific devices.

## References

  * [1] R. W. Reeder, I. Ion, and S. Consolvo, “152 simple steps to stay safe online: Security advice for non-tech-savvy users,” _IEEE Security & Privacy_, vol. 15, no. 5, pp. 55–64, 2017.
  * [2] S. Turner, J. R. Nurse, and S. Li, “When googling it doesn’t work: the challenge of finding security advice for smart home devices.” USENIX Association, Aug. 2021.
  * [3] E. Zeng, S. Mare, and F. Roesner, “End user security & privacy concerns with smart homes,” in _Proceedings of the Thirteenth USENIX Conference on Usable Privacy and Security_ , ser. SOUPS ’17. USA: USENIX Association, 2017, p. 65–80.
  * [4] J. Haney, S. Furman, and Y. Acar, “Smart home security and privacy mitigations: Consumer perceptions, practices, and challenges.” International Conference on Human-Computer Interaction, Copenhagen, -1, 07 2020. [Online]. Available: https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=929479
  * [5] J. M. Haney and S. M. Furman, “User perceptions and experiences with smart home updates,” in _2023 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2023, pp. 2867–2884.
  * [6] E. M. Redmiles, N. Warford, A. Jayanti, A. Koneru, S. Kross, M. Morales, R. Stevens, and M. L. Mazurek, “A comprehensive quality evaluation of security and privacy advice on the web,” in _29th USENIX Security Symposium (USENIX Security 20)_. USENIX Association, Aug. 2020, pp. 89–108. [Online]. Available: https://www.usenix.org/conference/usenixsecurity20/presentation/redmiles
  * [7] D. Barrera, C. Bellman, and P. Van Oorschot, “Security best practices: A critical analysis using iot as a case study,” _ACM Transactions on Privacy and Security_ , vol. 26, no. 2, pp. 1–30, 2023.
  * [8] T. N. R. I. 2021, “Shaping the global recovery,” December 2021. [Online]. Available: https://networkreadinessindex.org/introducing-the-network-readiness-index-2021/
  * [9] M. Silverio-Fernández, S. Renukappa, and S. Suresh, “What is a smart device?-a conceptualisation within the paradigm of the internet of things,” _Visualization in Engineering_ , vol. 6, no. 1, pp. 1–10, 2018.
  * [10] C. Geeng and F. Roesner, “Who’s in control? interactions in multi-user smart homes,” in _Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems_ , ser. CHI ’19. New York, NY, USA: Association for Computing Machinery, 2019, p. 1–13. [Online]. Available: https://doi.org/10.1145/3290605.3300498
  * [11] J. Haney, Y. Acar, and S. Furman, “”it’s the company, the government, you and i”: User perceptions of responsibility for smart home privacy and security,” in _30th USENIX Security Symposium (USENIX Security 21)_. USENIX Association, Aug. 2021, pp. 411–428. [Online]. Available: https://www.usenix.org/conference/usenixsecurity21/presentation/haney
  * [12] I. Ion, R. Reeder, and S. Consolvo, ““…No one can hack my Mind”: Comparing expert and Non-Expert security practices,” in _Eleventh Symposium On Usable Privacy and Security (SOUPS 2015)_. Ottawa: USENIX Association, Jul. 2015, pp. 327–346. [Online]. Available: https://www.usenix.org/conference/soups2015/proceedings/presentation/ion
  * [13] S. Zheng, N. Apthorpe, M. Chetty, and N. Feamster, “User perceptions of smart home iot privacy,” _Proc. ACM Hum.-Comput. Interact._ , vol. 2, no. CSCW, nov 2018. [Online]. Available: https://doi.org/10.1145/3274469
  * [14] B. Knieriem, X. Zhang, P. Levine, F. Breitinger, and I. Baggili, “An overview of the usage of default passwords,” in _Digital Forensics and Cyber Crime_ , P. Matoušek and M. Schmiedecker, Eds. Cham: Springer International Publishing, 2018, pp. 195–203.
  * [15] D.-P. Pham, D. Marion, M. Mastio, and A. Heuser, “Obfuscation revealed: Leveraging electromagnetic signals for obfuscated malware classification,” in _Annual Computer Security Applications Conference_ , ser. ACSAC ’21. New York, NY, USA: Association for Computing Machinery, 2021, p. 706–719. [Online]. Available: https://doi.org/10.1145/3485832.3485894
  * [16] E. Rodríguez, A. Noroozian, M. van Eeten, and C. H. Gañán, “Superspreaders: Quantifying the role of iot manufacturers in device infections,” _20th Annual Workshop on the Economics of Information Security (WEIS 2021)_ , 2021.
  * [17] H. Wang, W. Zhang, H. He, P. Liu, D. Luo, Y. Liu, J. Jiang, Y. Li, X. Zhang, W. Liu, R. Zhang, and X. Lan, “An evolutionary study of iot malware,” _IEEE Internet of Things Journal_ , vol. 8, no. 20, pp. 15 422–15 440, Oct. 2021.
  * [18] I. Lopez-Neira, T. Patel, S. Parkin, G. Danezis, and L. Tanczer, “‘internet of things’: How abuse is getting smarter,” 2019.
  * [19] L. F. Cranor, “A framework for reasoning about the human in the loop,” 1” 2008. [Online]. Available: https://kilthub.cmu.edu/articles/journal_contribution/A_Framework_for_Reasoning_About_the_Human_in_the_Loop/6620651
  * [20] A. Rostami, M. Vigren, S. Raza, and B. Brown, “Being hacked: Understanding victims’ experiences of $\\{$IoT$\\}$ hacking,” in _Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022)_ , 2022, pp. 613–631.
  * [21] T. Van Steen, E. Norris, K. Atha, and A. Joinson, “What (if any) behaviour change techniques do government-led cybersecurity awareness campaigns use?” _Journal of Cybersecurity_ , vol. 6, no. 1, p. tyaa019, 2020.
  * [22] M. Williams, J. R. C. Nurse, and S. Creese, “Privacy is the boring bit: User perceptions and behaviour in the internet-of-things,” in _2017 15th Annual Conference on Privacy, Security and Trust (PST)_ , 2017, pp. 181–18 109.
  * [23] J. M. Blythe, N. Sombatruang, and S. D. Johnson, “What security features and crime prevention advice is communicated in consumer IoT device manuals and support pages?” _Journal of Cybersecurity_ , vol. 5, no. 1, 06 2019, tyz005. [Online]. Available: https://doi.org/10.1093/cybsec/tyz005
  * [24] M. Fagan and M. M. H. Khan, “To follow or not to follow: A study of user motivations around cybersecurity advice,” _IEEE Internet Computing_ , vol. 22, no. 5, pp. 25–34, 2018.
  * [25] E. M. Redmiles, A. R. Malone, and M. L. Mazurek, “I think they’re trying to tell me something: Advice sources and selection for digital security,” in _2016 IEEE Symposium on Security and Privacy (SP)_ , 2016, pp. 272–288.
  * [26] E. M. Redmiles, M. L. Mazurek, and J. P. Dickerson, “Dancing pigs or externalities? measuring the rationality of security decisions,” in _Proceedings of the 2018 ACM Conference on Economics and Computation_ , ser. EC ’18. New York, NY, USA: Association for Computing Machinery, 2018, p. 215–232. [Online]. Available: https://doi.org/10.1145/3219166.3219185
  * [27] P. Emami-Naeini, H. Dixon, Y. Agarwal, and L. F. Cranor, “Exploring how privacy and security factor into iot device purchase behavior,” in _Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems_ , ser. CHI ’19. New York, NY, USA: Association for Computing Machinery, 2019, p. 1–12. [Online]. Available: https://doi.org/10.1145/3290605.3300764
  * [28] N. Abdi, K. M. Ramokapane, and J. M. Such, “More than smart speakers: Security and privacy perceptions of smart home personal assistants,” in _Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019)_. Santa Clara, CA: USENIX Association, Aug. 2019, pp. 451–466. [Online]. Available: https://www.usenix.org/conference/soups2019/presentation/abdi
  * [29] N. Nthala and I. Flechais, “Informal support networks: an investigation into home data security practices,” in _Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018)_. Baltimore, MD: USENIX Association, Aug. 2018, pp. 63–82. [Online]. Available: https://www.usenix.org/conference/soups2018/presentation/nthala
  * [30] S. Das, J. Lo, L. Dabbish, and J. I. Hong, “Breaking! a typology of security and privacy news and how it’s shared,” in _Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems_ , 2018, pp. 1–12.
  * [31] S. Das, T. H.-J. Kim, L. A. Dabbish, and J. I. Hong, “The effect of social influence on security sensitivity,” in _10th Symposium On Usable Privacy and Security (SOUPS 2014)_ , 2014, pp. 143–157.
  * [32] E. S. Poole, M. Chetty, T. Morgan, R. E. Grinter, and W. K. Edwards, “Computer help at home: Methods and motivations for informal technical support,” in _Proceedings of the SIGCHI Conference on Human Factors in Computing Systems_ , ser. CHI ’09. New York, NY, USA: Association for Computing Machinery, 2009, p. 739–748. [Online]. Available: https://doi.org/10.1145/1518701.1518816
  * [33] E. Spero and R. Biddle, “Out of sight, out of mind: Ui design and the inhibition of mental models of security,” in _New Security Paradigms Workshop 2020_ , ser. NSPW ’20. New York, NY, USA: Association for Computing Machinery, 2020, p. 127–143. [Online]. Available: https://doi.org/10.1145/3442167.3442174
  * [34] C. Herley, “So long, and no thanks for the externalities: the rational rejection of security advice by users,” in _Proceedings of the 2009 workshop on New security paradigms workshop_ , 2009, pp. 133–144.
  * [35] E. M. Redmiles, S. Kross, and M. L. Mazurek, “How i learned to be secure: A census-representative survey of security advice sources and behavior,” in _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_ , ser. CCS ’16. New York, NY, USA: Association for Computing Machinery, 2016, p. 666–677. [Online]. Available: https://doi.org/10.1145/2976749.2978307
  * [36] B. Bouwmeester, E. Rodríguez, C. Gañán, M. van Eeten, and S. Parkin, “”the thing doesn’t have a name”: Learning from emergent Real-World interventions in smart home security,” in _Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021)_. USENIX Association, Aug. 2021, pp. 493–512. [Online]. Available: https://www.usenix.org/conference/soups2021/presentation/bouwmeester
  * [37] S. Turner, “Approaches and technologies to support home users’ engagement with cyber security,” 2020, pp. 58–61.
  * [38] Cybersecurity and I. S. A. CISA. (2019) Security tip (st17-001). Cybersecurity and Infrastructure Security Agency CISA. (last visited 11-02-2022). [Online]. Available: https://www.cisa.gov/uscert/ncas/tips/ST17-001
  * [39] V. Braun and V. Clarke, “One size fits all? what counts as quality practice in (reflexive) thematic analysis?” _Qualitative research in psychology_ , vol. 18, no. 3, pp. 328–352, 2021.
  * [40] G. S. Online. (2019) How to safeguard iot gadgets at home. (last visited 01-02-2022). [Online]. Available: https://www.getsafeonline.org/personal/blog-item/how-to-safeguard-iot-gadgets-at-home/
  * [41] Ministerie van Economische Zaken en Klimaat. (2022) Veelgestelde vragen over slimme apparaten. Ministerie van Economische Zaken en Klimaat. (last visited 11-02-2022). [Online]. Available: https://bit.ly/3o0vzvF
  * [42] The White House (US), “Biden–harris administration announces cybersecurity labeling program for smart devices to protect american consumers,” , 2023, accessed: 2022-08-04.
  * [43] G. Chalhoub, I. Flechais, N. Nthala, and R. Abu-Salma, “Innovation inaction or in action? the role of user experience in the security and privacy design of smart home cameras,” in _Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020)_. USENIX Association, Aug. 2020, pp. 185–204. [Online]. Available: https://www.usenix.org/conference/soups2020/presentation/chalhoub
  * [44] K. Krol, J. M. Spring, S. Parkin, and M. A. Sasse, “Towards robust experimental design for user studies in security and privacy.” IEEE, 2016.
  * [45] C. Lewis and J. Rieman, _Task-centered user interface design_ , 1993.
  * [46] N. McDonald, S. Schoenebeck, and A. Forte, “Reliability and inter-rater reliability in qualitative research: Norms and guidelines for cscw and hci practice,” _Proceedings of the ACM on human-computer interaction_ , vol. 3, no. CSCW, pp. 1–23, 2019.
  * [47] I. MORI, “Literature review on connected devices within enterprise networks,” March 2021. [Online]. Available: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1073668/Literature_review_on_connected_devices_within_enterprise_networks.pdf
  * [48] R. Wash, “Folk models of home computer security,” in _Proceedings of the Sixth Symposium on Usable Privacy and Security_ , 2010, pp. 1–16.
  * [49] J. M. Haney and S. M. Furman, “Work in progress: Towards usable updates for smart home devices,” in _Socio-Technical Aspects in Security and Trust_ , T. Groß and L. Viganò, Eds. Cham: Springer International Publishing, 2021, pp. 107–117.
  * [50] T. van Steen, “When choice is (not) an option: Nudging and techno-regulation approaches to behavioural cybersecurity,” in _Augmented Cognition_ , D. D. Schmorrow and C. M. Fidopiastis, Eds. Cham: Springer International Publishing, 2022, pp. 120–130.
  * [51] B. J. Fogg, _Tiny habits: The small changes that change everything_. Eamon Dolan Books, 2019.
  * [52] M. Osman, S. McLachlan, N. Fenton, M. Neil, R. Löfstedt, and B. Meder, “Learning from behavioural changes that fail,” _Trends in Cognitive Sciences_ , vol. 24, no. 12, pp. 969–980, 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S1364661320302242
  * [53] Y. T. Chua, S. Parkin, M. Edwards, D. Oliveira, S. Schiffner, G. Tyson, and A. Hutchings, “Identifying unintended harms of cybersecurity countermeasures,” in _2019 APWG Symposium on Electronic Crime Research (eCrime)_. IEEE, 2019, pp. 1–15.
  * [54] A. Ponticello, M. Fassl, and K. Krombholz, “Exploring authentication for $\\{$Security-Sensitive$\\}$ tasks on smart home voice assistants,” in _Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021)_ , 2021, pp. 475–492.
  * [55] J. Haney and S. Furman, “User perceptions and experiences with smart home updates,” in _2023 IEEE Symposium on Security and Privacy (SP)_. IEEE Computer Society, 2022, pp. 782–799.
  * [56] European Commission. (2021) Questions and answers: Strengthening cybersecurity of wireless devices and products. (last visited 15-02-2022). [Online]. Available: https://ec.europa.eu/commission/presscorner/detail/en/QANDA_21_5635a
  * [57] UK Department of Digital, Culture, Media and Sport, “Code of practice for consumer iot security,” https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/971440/Code_of_Practice_for_Consumer_IoT_Security_October_2018_V2.pdf, 2018, accessed: 2022-07-10.
  * [58] S. Prange, N. Thiem, M. Fröhlich, and F. Alt, ““secure settings are quick and easy!” – motivating end-users to choose secure smart home configurations,” in _Proceedings of the 2022 International Conference on Advanced Visual Interfaces_ , ser. AVI 2022. New York, NY, USA: Association for Computing Machinery, 2022. [Online]. Available: https://doi.org/10.1145/3531073.3531089
  * [59] B. J. Fogg and J. Hreha, “Behavior wizard: A method for matching target behaviors with solutions,” in _International Conference on Persuasive Technology_. Springer, 2010, pp. 117–131.
  * [60] M. Fagan, M. Fagan, K. N. Megas, K. Scarfone, and M. Smith, _Foundational cybersecurity activities for IoT device manufacturers_. US Department of Commerce, National Institute of Standards and Technology, 2020.

##  Appendix A The 4 top pieces of advice

### Advice 1: Changing the default password

  1. 1.

UK - “Consider the factory set password a placeholder. You should immediately
change it the moment you start using the new device. Otherwise, anyone who
previously had access to the factory settings password can access your
device.”

  2. 2.

US - “Some Internet-enabled devices are configured with default passwords to
simplify setup. These default passwords are easily found online, so they don’t
provide any protection. Choose strong passwords to help secure your device.”

  3. 3.

NL - “Wijzig het standaardwachtwoord en stel een sterk wachtwoord in.”(”Change
the default password and set up a strong password”)

### Advice 2: Use different passwords for different devices

  1. 1.

UK - ”Use different passwords for different devices. Don’t reuse the same, or
even similar, passwords across the many cloud-based gadgets you own. If one
device is compromised, it could put all other devices at risk. Getting rid of
careless habits like this is essential for keeping your home network secure.”

  2. 2.

US - ”Reusing a password, even a strong one, endangers your accounts just as
much as using a weak password. If attackers guess your password, they would
have access to your other accounts with the same password.” ”Use the following
techniques to develop unique passwords for each of your accounts: Use
different passwords on different systems and accounts.”

  3. 3.

NL - ”Gebruik verschillende wachtwoorden voor verschillende accounts.”
(”Use different passwords for different accounts”)

### Advice 3: Install updates

  1. 1.

UK - ”Keep device software up to date.” ”Firmware updates allow manufacturers
to install software patches in case a security vulnerability is detected.”

  2. 2.

US - ”Ensure you have up-to-date software.” ”When manufacturers become aware
of vulnerabilities in their products, they often issue patches to fix the
problem. Patches are software updates that fix a particular issue or
vulnerability within your device’s software.” ”Make sure to apply relevant
patches as soon as possible to protect your devices.”

  3. 3.

NL - ”Krijg je een melding om een update te doen? Doe het direct. Zie je in
het scherm van je smartphone, tablet of laptop been update-notificatie van je
slimme apparaat? Voer de update direct uit. Zo blijft je slimme apparaat
veilig. En weet je zeker dat je up-to-date bent.”
(”Do you get a notification to do an update? Do it immediately. Do you see an
update notification from your smart device on the screen of your smartphone,
tablet, or laptop? Run the update immediately. This keeps your smart device
safe. And you can be sure that you are up-to-date.”)

### Advice 4: Activate automated updates/set a periodic reminder in your
calendar

  1. 1.

UK - ”Some devices, like your smartphone, can auto-update security fixes. On
the other hand, the router, the smart light bulbs, or the smart fridge might
not. If auto update features are available, enable them on all your devices.
If not, set up the device so you get alerts for newly available firmware
updates. Then you can immediately update your devices on time.”

  2. 2.

US - ”Some software will automatically check for updates, and many vendors
offer users the option to receive updates automatically. If automatic options
are available, the Cybersecurity and Infrastructure Security Agency (CISA)
recommends that you take advantage of them. If they are not available,
periodically check your vendor’s websites for updates.” ”What is the
difference between manual and automatic updates? Users can install updates
manually or elect for their software programs to update automatically. Manual
updates require the user or administrator to visit the vendor’s website to
download and install software files. Automatic updates require user or
administrator consent when installing or configuring the software. Once you
consent to automatic updates, software updates are “pushed” (or installed) to
your system automatically.”

  3. 3.

NL - ”Hoe update ik mijn slimme apparaten? Stap 1. Open de app van je slimme
apparaat. Stap 2. Kijk bij ‘Instellingen’. Stap 3. Klik daar op ‘Updaten’.
Stap 4. Stel ‘Automatisch updaten’ in. Soms is automatisch updaten niet
mogelijk. Zet dan een herinnering in je agenda om elke 1e dag van het nieuwe
kwartaal je updates te chicken. Krijg je een melding om een update te doen?
Doe het direct. Heb je geen app van je slimme apparaat? Ga dan naar de website
van de fabrikant en zoek op ’update’.”
(”How do I update my smart devices? Step 1. Open the app of your smart device.
Step 2. Look at ’Settings’. Step 3. Click on ’Update’ there. Step 4. Set up
’Automatic update’. Sometimes automatic updating is not possible. In that case
you can put a reminder in your calendar to check your updates every 1st day of
the new quarter. Do you get a notification to do an update? Do it right away.
Don’t have an app for your smart device? Go to the manufacturer’s website and
search for ’update.’”)

##  Appendix B IoT devices comparison

|  Advice I |  Advice II |  Advice III |  Advice IV
---|---|---|---|---
SMART ENTERTAINMENT |  |  |  |
Samsung UE49MU8000 |  |  | ✓ | ✓
LG UHD TV 43UP80 |  |  | ✓ | ✓
Philips PUS8506 |  |  | ✓ | ✓
Hue Amaze EMEA |  |  | ✓ | ✓
Lumiman Smart Wifi Light Bulbs |  |  | ✓ |
Govee LED Light Bulb |  |  | ✓ |
NEBULA Anker Capsule, Smart Wi-Fi Mini Projector |  |  | ✓ |
NVIDIA SHIELD Android TV Pro 4K HDR Streaming Media Player |  |  | ✓ | ✓
SMART HEALTH |  |  |  |
Withings Body Cardio |  |  | ✓ |
Garmin Index S2 |  |  | ✓ |
Arboleaf Smart Scale |  |  | ✓ |
Xiaomi Mi Air Purifier 3H |  |  | ✓ |
Fossil Monroe Hybrid HR Watch FTW7039 |  |  |  |
Samsung Galaxy Watch 4 Classic |  |  | ✓ |
Peloton Bike+ |  |  | ✓ |
NordicTrack Commercial 2950 Treadmill |  |  | ✓ |
SMART SECURITY |  |  |  |
Reolink Argus 3 Pro |  | ✓ | ✓ |
Google Nest Cam IQ Outdoor |  |  |  | ✓
V380 Pro |  |  | ✓ |
Ring Pro 2 |  |  | ✓ | ✓
UniFi G4 Doorbell |  |  | ✓ |
Eufy 2K Battery Doorbell |  |  | ✓ | ✓
Fibaro Smoke Sensor |  |  | ✓ |
Bold Smart Lock SX-33 |  |  | ✓ |
SMART ASSISTANTS |  |  |  |
Echo Studio |  |  |  | ✓
Nest Audio |  |  |  | ✓
Sonos One Smart Speaker |  |  | ✓ | ✓
Apple HomePod mini |  |  | ✓ | ✓
Athom Homey Pro |  |  | ✓ | ✓
JBL Link Portable |  |  | ✓ |
Wink Hub 2 |  |  | ✓ | ✓
Bose Home Speaker 500 |  |  | ✓ | ✓
SMART HOME APPLIANCES |  |  |  |
iRobot Roomba J7+ |  |  |  | ✓
Xiaomi Viomi S9 |  |  | ✓ |
Miele DG 7140 |  |  |  |
LG GC-X247CSAV Refrigerator |  |  | ✓ |
Anova Precision Oven |  |  | ✓ |
Instant Pot Smart WiFi |  |  |  |
Hamilton Beach Smart Coffee Maker |  |  |  |
Philips Sonicare Prestige 9900 HX9992/12 |  |  | ✓ |

Table 6: IoT comparison table - Here we present an overview of the 40 selected
IoT devices and the extent that each piece of advice (Advice I: Changing the
default password, Advice II: Use different passwords for different devices,
Advice III: Install updates, IV: Activate automated updates/set a periodic
reminder in your calendar) could be applied.