News for hackers. Stuff that matters.

A comment on Life Is About to Get Harder for Websites Without HTTPS. Parent comment

Re:Life Is About to Get Harder for Websites Without HTTPS by akvadrako on Wednesday July 12, 2017 @08:55AM (#14752068)
So any random webpage can talk to your Hue bridge?

I'm surprised they even allow such cross-domain requests, but this anyway doesn't seem safe.

[ Parent | on HN ]
Re:Life Is About to Get Harder for Websites Without HTTPS by cryo on Wednesday July 12, 2017 @01:49PM (#14754738)
Cross-domain is needed, otherwise an app/webapp couldn't talk to the bridge since the bridge only serves the REST API.

However in order to send control commands and query light states the app/webapp needs to authenticate and create a account, which is only possible for a few seconds after pressing a physical bridge button.

[ Parent | on HN ]