Including private keys of any sort in the firmware is kind of a no no
You need some way for the device to communicate with your backend, and private keys work pretty well. For the devices I work on these keys are unique for each device, and transferred over to it during the setup process.
Re:Pwn the LIFX Mini white
by alanfranzoni on Wednesday January 30, 2019 @04:21AM
(#19033735)
Not necessarily, if the private key is different for every device. What would you have done instead?
seems to be the same in all bulbs :(
Provisioning each device with a unique certificate signed by a vendor CA is what I would call absolute best practice.
It's possible this certificate isn't that and is instead reused across all bulbs. We don't know that. And even if that is the case, there are no details on what this certificate is even used for that would allow us to determine if this is any sort of security problem.
It depends what exactly the keys are used for. If it's just for secure communication between the app and the bulb, and the keys are different for each bulb, I don't see any issue with this.