Isn't that common across all watches that connect to your phone these days? Please correct me if I'm wrong.

Edit: Also, not saying it's a good thing.

My bathroom scale requires gps access via my phone if I want to log data to it...

yeah that's not good! That's why I don't want to buy a "smart" fridge or any of these appliances that require Wifi access.

From my understanding, apps need location permissions if they want to scan for available bluetooth devices rather than having the user pair in the bluetooth settings app. The reason being that advertisers set up bluetooth beacons all over the place and used passive scanning in apps to collect the users location.

What's not clear to me is why they really need to be able to scan for bluetooth. Surely requesting location permissions is worse UX than having the user go to the settings app to pair.

The lowest common denominator user is more afraid of visiting the settings menu than they are of clicking allow on just about any permissions popup.

ffs all it needed to do was talk to Apple Health and I’d have bought it.

from a financial perspective they would assume one persons data is worth maybe 50$ a year (a random number) on top of maybe another 50$ in subscriptions they can sell. Assuming most such products service the business for up to 3 years, you are looking at an additional 300$ upfront that the business loses giving the data away to someone like Apple. Also the value gain from purely having such a business of subscriptions and data collection is probably another 100$ per customer. Thats close to 500$ for that thing.

Someone like Casio could just sell it for 500$ and collect their future cashflows right away. However, the customer turnout might be significantly less than 55$ they are selling it for.

So the only way to sell it for profit is to keep the data and make a subscription (which may or may not exist yet for Casio).

They could just sell it at an honest price with an honest profit. It’s an upsell from cheap F91Ws so they could have made more money just by selling me a thing that reads from Apple Health. It doesn’t even need to track steps itself.

I also disagree my email address and step data is worth $450 to them.

Let’s be honest. This thing is not innovative. It’s going to be using cheap commodity chips. Its selling point is nostalgia. I find it hard to believe it’s not already profitable at $55.

While I empathize with your feelings about lock-in, I encourage you to see that we live in an amazingly empowering era. I would wager that with $20 in credits for the LLM flavor of the week and and an equally expensive BLE-to-USB dongle (try the nRF52840 dongle), you will have the protocol reverse-engineered overnight. BLE protocols are often very low-hanging fruit for this type of effort.

Yes, it's annoying this stuff isn't open source from the get-go, but it has never been easier to open hardware up for yourself and others.

+1000.

There should be bounties for open sourcing drivers/apps like these and generally making 'clean'/better interfaces to hardware devices, now that it's so much easier.

Claude Code reverse engineered cheap (Android only) usb and wifi endoscopes here, wrote/flashed/hardware-in-the-loop developed python+arduino libraries, etc.

It's a completely new world.

@wpm, happy to fund the nRF52840 dongle if you want to try this + release code!

Have you released your reverse engineered endoscope camera work? It's something I've been thinking about doing myself, since the vendor apps leave a lot to be desired.

Yes! https://pypi.org/project/supercamera/

Feel free to contribute [0], let me know if it works with the cameras you have or not, etc.! Cheers

[0] https://github.com/Revise-Robotics/supercamera-endoscope

> There should be bounties

There are https://bounties.fulu.org

Wow, what a great idea. Thanks for the link!

Is it really as easy as you say? I have one of these Casio watches and plenty of spare Claude credits. Wouldn’t mind doing this but no idea where to begin.

Even I am curious about how people are doing this

Responding to you and @thewhitetulip

If you ask Claude how to do it, it might already give you some strategy that's reasonable (at least, it's good to see what it thinks)

Make sure to use Fable, and preferably have the Max plan (or plenty of credits)

LLMs can do very good work when they're unattended and optimize towards a goal that's unambiguous / for which you have a reference.

Generally speaking, in hardware, this means having a "rig" ie a testbed where the AI can send commands, observe output, and iterate on its own. You want autonomy, not babysitting (as much as possible)

In the case of this Casio watch, I would start by giving Claude Code context on what you're trying to achieve (read&decode messages sent probably over BLE, reverse engineer the protocol, get to a point where it can send valid messages itself). The goal should be a python/command line tool that can sniff packets, decode them, and send them. (step by step, starting with sniffing)

Get the nRF52840 USB dongle mentioned. Have Claude Code talk to the dongle. Ask it to list devices it sees. Ask it to see/detect the Casio watch. Use the proprietary Casio app and ask CC to record the sequence and decode the messages (explaining to it what you did in the app)

Also: have it do research - has this protocol been cracked/documented before? Is there an Android app for this Casio app which could be decompiled (usually more easily than the equivalent iOS app)?

Reach out if I can help - my offer for a dongle stands for anyone who wants to do this! It looks like a cool watch, it shouldn't be held hostage. :-)

From my experience Fable will reject this request - its pretty trigger-happy with it's safety detector for reverse engineering, even if you push it on right-to-repair. However Opus 4.8 is more than capable of doing it, with a bit of guidance.

Hi Greg, I am Claude Code junior specialist from Czech Republic and also huge Casio fan. I've been ignoring all bluetooth enabled models in the past, since I had a lot of negative experience with proprietary apps (Sony Music Center, Ultrahuman etc). This is not me first time thinking about reverse engineering products app, I love open hardware and I wanted to contribute to the community, but while doing my research (which Claude agrees with), I've figured out that it might not be as easy as I thought. For example, Googles Fitbit Air is according to some encrypting its traffic in a way, that it reaches Googles Cloud first, unencrypts and then reaches the app itself. How would you approach this issue? By the way, the dongle offer still stands? ;)

Offer still stands! email me (my email is in my profile)

When there’s a will, there’s a way :) I’m not immediately sure re Fitbit Air (that’s nasty if it’s e2e encrypted!), but… maybe it doesn’t pin the server certificate and you can intercept communications?

Seems like you would have fun reversing this! :) reach out!

> Wouldn’t mind doing this but no idea where to begin.

Literally just ask Claude where to begin

Having the LLM run the proprietary app through ghidra (which I think even has an MCP now), would likely give it some useful clues too

ble is just transport layer, if the actual data is encrypted, you can get nothing.

One of our device FW at first transmit raw data through gatt service, then folk at gadget bridge reverse engineer it, which does not sound good to stakeholder, so we have to encrypt the data between phone-device.

Quite possible transport is encrypted, but that can likely be overcome with some RE on the Android app. Given the price of this piece of hardware, it's likely recoverable with moderate effort. At least worth a try.

yeah, my point is "1 night and $20 of Claude token" maybe not enough.

Also you dont really need the nrf52840 dongle if you want sniffing(Also unlikely to work after the pairing process is done), you can use btsnoop on Android phone to record data, then analyze it with wireshark.

You're right, I was representing a best-case scenario with an intention to be inspiring.

And yes, the Android approach works too and I have done exactly that with Claude previously. The BLE dongle is however a platform-independent approach.

Q: How can we achieve world peace?

HN: I'd wager that with $20 in LLM tokens ...

Cracks me up every time lol

This isn't untrue. I had the same thought when I unboxed my Casio 3565 a week ago and learned that I had been bamboozled.

Except all I wanted was a watch that could 1. keep itself set correctly, and 2. ping my phone when I lose it. I didn't want a project. I have enough projects. I am drowning in half finished projects. They are stacked up to the ceiling. They threaten to crush me as I sleep. No more!

There is an Fdroid app "Casio G-Shock Smart Sync" Not sure if it supports now but most likely may support in future.

This is an unofficial app for Casio G-Shock, Edifice, and Pro Trek watches. It allows you to control your watch, sync data, and configure settings without a Casio ID. It offers a faster, privacy-focused, and more powerful alternative to the official Casio app.

Key Features check ------------------ - No Account Required: Skip the Casio ID login entirely.

From https://fdroid.gitlab.io/jekyll-fdroid/packages/org.avmedia....

While Casio app may be despicable, in Android world have a look at https://gadgetbridge.org/.

Gadgetbridge is open source provides a lot of "drivers" for different BT devices from Casio, Sony, Pebble, Garmin to Xiaomi and allows to live without monstrous in size and tracking proprietary apps.

If the watch gets any popular, it will take at most weeks for someone to vibecode open source app for this.

I complained to the relevant GDPR authority (German) and never heard back. It's blatantly illegal - overprocessing of PII - to require registration for connecting two devices owned by the same person, in the same room. There's no fathomable necessary or legitimate use.