News for hackers. Stuff that matters.
Re:Pwn the LIFX Mini white by Benjamin_Dobell on Wednesday January 30, 2019 @08:19AM (#19034762)
Attack vector details are a bit sketchy, but there's at the very least some concerns raised. Particularly surrounding that private key. However, I will say that I'm not at all surprised that the firmware isn't of the highest quality. I just picked up some LIFX bulbs a couple of months ago and have been hugely disappointed with the firmware.

The mobile apps are fine, but the firmware just seems incredibly... not smart.

For example if you enable a schedule to address your circadian rhythm, then turn the light off with a wall switch at one point in the schedule and turn it back at another time. The light makes zero attempt to adjust its brightness and colour it just stays at the old setting.

Sure it hasn't had power, but it's not that hard to grab the date/time via NTP. Ideally there'd be a tiny battery just keeping a clock ticking over.

Re:Pwn the LIFX Mini white by _pmf_ on Wednesday January 30, 2019 @08:40AM (#19034901)
> For example if you enable a schedule to address your circadian rhythm, then turn the light off with a wall switch at one point in the schedule and turn it back at another time.

That's what I would expect as an override mechanism for the scheduled behavior: turning off and on sets regular as opposed to schedules brightness.

Re:Pwn the LIFX Mini white by Benjamin_Dobell on Wednesday January 30, 2019 @09:00AM (#19035042)
Probably just a poor explanation by me. The behaviour I'm attempting to explain is definitely not what anyone would expect - well unless you're technically inclined and somehow expect it to fail. There's 100s of reports of similar issues running back years (I've also reported it to support myself).

I'll try explain in greater detail, LIFX bulbs allow you to set a brightness and colour curve that's supposed to represent the colour and brightness at any time of day. Instead of adhering to this curve, if you turn the light off at the switch at midday, and you turn the light on again at midnight you'll be blasted with bright white/blue light, rather than dim yellow light that you've configured.

I'd say that's instantly unforgivable - if support had confirmed to me that this was expected I would have immediately returned my bulbs - they did not.

Even being a technical person and reasoning that they probably don't have a battery. The very least the light could do is fetch the current time of day then fade to the correct setting ASAP. Instead, the daily schedule, which seems to be made up of "start" and "end" points, doesn't seem to correct until hours later when the next start/end point is hit.

Like many others, I run circadian rhythm software on my monitors/displays. If I turn my computer, tablet or mobile phone off at midday, and on again at midnight I don't expect it to blast me in the face with blue light. Thankfully no other devices I own have this glaring fault.

Re:Pwn the LIFX Mini white by soylentcola on Wednesday January 30, 2019 @10:05AM (#19035568)
I've got some Hue bulbs and while I believe newer versions of the hub/lamps have the option to return to last setting when power cycled via wall switch, I can't say the alternative is necessarily worse in terms of the user.

The idea is that I can schedule the lights to do their thing or I can control via a phone app, but if someone else is at my house they can always just turn a light off and on at the switch to reset to full brightness.

I actually do this often when I need bright light in a room that is currently dim and I don't want to pull out my phone and tap the widget. Likewise, if my WiFi access point was being flaky for whatever reason, I would not want to be stuck with lights in some dimmed or colored state all the time. I'd want a way to make them fail back to being regular light bulbs.

I think that's the main idea. You get all the fancy scheduling and remote control, but in the end, you need a simple way for them to fall back to being plain old light bulbs if something isn't working.

Re:Pwn the LIFX Mini white by Benjamin_Dobell on Wednesday January 30, 2019 @10:11AM (#19035619)
If this was defined behaviour and it fell back to being a dumb light, I'd be disappointed, but could live with that.

Unfortunately, that's not the case. I gave the example of going from day to night, and the bulb being bright around midnight. However, my wife gets equally frustrated in the morning, when she turns on the light in our ensuite and it's dim because it was last on late the night before.

Re:Pwn the LIFX Mini white by axiometry on Wednesday January 30, 2019 @09:59AM (#19035501)
You're not really supposed to power cycle smart home devices. I would suggest just getting a smart switch.
Re:Pwn the LIFX Mini white by _pmf_ on Wednesday January 30, 2019 @11:51AM (#19036741)
I can't tell if this is meant sarcastically or not.
Re:Pwn the LIFX Mini white by Benjamin_Dobell on Wednesday January 30, 2019 @10:11AM (#19035626)
Any recommendations - specifically for replacing physical light switches?