Indeed, but will a non-tecnical user know that. It's been of increasing frequency non-technical users ask for disks to be wiped though, they are aware it contains sensitive information... but a light bulb? Maybe no lightbulb moment for them.

I don't know how to properly address this without wiping. Maybe not use wifi for the bulbs in the first place or not use IoT at all? Consumers will not care about that.

Either you trust the lightbulb provider to protect your creds better or don't use it. In my opinion the lifx is reasonably protected and far from being the worst offender here: the attack doesnt work over the air, and depends on physical access to a pre-setup bulb and involves physical labour to access the credentials (needs cutting out the board, removing protecting glue from the board, dumping firmware). This is not really mass-exploitable. Services like wigle will allow to see where the wifi is located though, but the bar for attacking is pretty high.

Have a look here for really awfull IoT sec:

https://mjg59.dreamwidth.org/40397.html

What are world we live in where we have to put trust in our lightbulb provider

Given that bulbs have always been electrical devices capable of malfunctioning and burning our house down, we have been living in it for decades.

Hard drives are designed to store data, it is very explicit that they have data on them.

Lightbulbs? Not really. Especially for people who don't work in this field.

People throw away or resell other stuff as well that has Wifi credentials in it (or will have in the future):

- sale of used smart TV

- thrown out wifi range extenders

- used wifi enabled cameras

- your smart fridge, toaster, whatever

You will not get Google Home Mini / Alexa levels of security with these.

Explain that to Average Joe.