The S in IoT is for Security

Re:The S in IoT is for Security by Spivak on Monday March 22, 2021 @12:18PM (#26542908)

Yeah this is so far from pwning that it’s hilarious to be presented as such. This is literally authorized access. He built an integration for his smart bulbs the same way Google Home or HomeKit would access it but with some weird Wi-Fi paranoia that actually made him less secure.

The security model of pretty much all smart lighting "if you can reach me on the network you're trusted" just like the security of light switches "if you can reach the switch you can flip it."

[ Parent | on HN ]

Re:The S in IoT is for Security by spongechameleon on Monday March 22, 2021 @12:46PM (#26543278)

I mean the alternative was installing the propietary app so I would say this is still a big win. But also yes, any wifi capable device in your home with no authorization is clearly a disaster waiting to happen.

[ Parent | on HN ]

Re:The S in IoT is for Security by Spivak on Monday March 22, 2021 @01:15PM (#26543674)

I don't disagree that it's a huge improvement over some proprietary app but I still don't think "using the light's API as designed" counts as pwning it.

It's the same API that openHAB or Home Assistant would consume to control it.

[ Parent | on HN ]