Say you wanted to build a protocol for IoT stuff. What would be on your feature list?
Low power: it should not require much in the way of network traffic or heartbeats so that you could leave the radio mostly off.
Mesh networking: ideally the devices should be able to repeat commands so that they could be low-power and not have to broadcast across entire houses.
Secure: it should have specific ways to join a network that don't require a keyboard on the device.
IoT application focused: the protocol should make it easy to do things like turn a device on/off, set a value or read a value.
Z-Wave and Zigbee do these things (for the most part), while WiFi is sort of hacked to try to maybe accomplish it. For instance, my Z-wave thermostat has been running off the same lithium AA batteries for about a year now, and the battery level is at 77%. I can't imagine a WiFi device being able to achieve that.
Isn't this idea hiding the problem though? While using uncommon hardware and protocols may thwart certain users, it's really not solving the problem of security. It's somewhat similar to the idea of using a hidden wireless network and calling that security instead of securing your network with WPA2, etc.
As these devices become more popular, we'll start seeing more Zigbees and Z-wave devices become commodity hardware.
Not at all, anyone can "join" the network, but nobody can decrypt the traffic without the key.
Zigbee has built-in, easy, encryption. You simply set your router to allow unsecured joins temporarily whenever you get a new device, which then learns the key.
When the network is set to allow only secure joins only devices pre-configured with the key can see anything other than encrypted frames.
I've installed tens (if not hundreds) of thousands of Zigbee devices over the last handful of years. Zigbee may be uncommon in residential, but it is not uncommon.
Compared with wifi, though? Trying to screw with your wifi equipment requires just about any laptop sold in the last ten years. Trying to screw with your Zigbee equipment would presumably require me to go find some kind of dongle.
Of course, wifi has gotten more secure over time to the point that I'd be more concerned about giving the devices internet access than I would about intruders on the network.
Sure, in the world there are probably more wifi devices, and I'll agree that wifi adapters are as mainstream as it gets. But just because the hardware to mess with Zigbee stuff isn't consumer mainstream doesn't mean the devices don't exist and aren't "used that much," as the comment OP incorrectly claimed.
In just one highrise project I did in Las Vegas last year we installed something like 65,000 Zigbee devices, and that's not atypical for highrise hotel construction. Zigbee is everywhere in building automation.
