# A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic

arXiv: https://arxiv.org/abs/1705.06805 · HTML: https://mlsanity.com/paper/1705.06805/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 May 2017.

## Built on by (most cited first, 6 of 6)

- [Revisiting IoT Device Identification](https://mlsanity.com/paper/2107.07818/) (2021)
- [ZEST: Attention-based Zero-Shot Learning for Unseen IoT Device Classification](https://mlsanity.com/paper/2310.08036/) (2023)
- [What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale](https://mlsanity.com/paper/2510.13817/) (2025)
- [Analyzing Consumer IoT Traffic from Security and Privacy Perspectives: a Comprehensive Survey](https://mlsanity.com/paper/2403.16149/) (2024)
- [Guarding Digital Privacy: Exploring User Profiling and Security Enhancements](https://mlsanity.com/paper/2504.07107/) (2025)
- [Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling](https://mlsanity.com/paper/2608.15465/) (2026)

## Abstract (arXiv)

The increasing popularity of specialized Internet-connected devices and appliances, dubbed the Internet-of-Things (IoT), promises both new conveniences and new privacy concerns. Unlike traditional web browsers, many IoT devices have always-on sensors that constantly monitor fine-grained details of users' physical environments and influence the devices' network communications. Passive network observers, such as Internet service providers, could potentially analyze IoT network traffic to infer sensitive details about users. Here, we examine four IoT smart home devices (a Sense sleep monitor, a Nest Cam Indoor security camera, a WeMo switch, and an Amazon Echo) and find that their network traffic rates can reveal potentially sensitive user interactions even when the traffic is encrypted. These results indicate that a technological solution is needed to protect IoT device owner privacy, and that IoT-specific concerns must be considered in the ongoing policy debate around ISP data collection and usage.