re: two way authentication
Surely the selling point of IoT is convenience. Having to rummage around your house pushing buttons to pair your phone with your numerous devices sounds rather bothersome. Sounds like we're putting IoT in the too much hassle basket.
Expect most of the IoT features in most devices to be unused. They're be like the VCR clocks that flash 00:00 for their whole life.
Unfortunately, most devices will likely come with unsecured IoT access to allow you to get going quicker.
Biting the hand that feeds IT
