Discarded smart lightbulbs reveal your WiFi passwords, stored in the clear

Re:Discarded smart lightbulbs reveal your WiFi passwords, st... by PaulHoule on Thursday February 28, 2019 @11:40AM (#19272630)

Phillips Hue doesn't have this problem because it uses Z Wave and not WiFi.

You do need the hub, but the attack surface is reduced, the basic bulbs are cheaper, etc. There probably is key material in the bulb, but who wants to impersonate a light that can only exchange simple binary (no strings to parse) messages with the bridge?

[ Parent | on HN ]

Re:Discarded smart lightbulbs reveal your WiFi passwords, st... by b1r6 on Thursday February 28, 2019 @11:49AM (#19272710)

I thought they were ZigBee, and integration with Z-Wave controllers was through Philips' web services?

https://www.quora.com/Is-Phillips-Hue-hub-compatible-with-Z-...

But I would say in general, Z-Wave doesn't have as much of this problem. Especially if we're talking Z-Wave Plus devices, which most coming out today are. Even better if they have the S2 security!

[ Parent | on HN ]

Re:Discarded smart lightbulbs reveal your WiFi passwords, st... by PaulHoule on Thursday February 28, 2019 @01:33PM (#19273740)

You are right, it is ZigBee.

[ Parent | on HN ]

Re:Discarded smart lightbulbs reveal your WiFi passwords, st... by josteink on Thursday February 28, 2019 @11:57AM (#19272776)

Same for IKEA Trådfri, but it uses Zigbee.

[ Parent | on HN ]