Yeah but theoretically, you should control your own devices, and be able to decrypt what they're sending because you have access to the keys they're using. (of course I realize this is complete bs, they're black boxes). Richard Stallman is looking less crazy now with all his warnings about "tivoization"
This.
When I said HTTP, I meant to include HTTPS. Intercepting HTTPS and filtering it is actually rather simple, and avoiding certificate warnings only slightly less so by deploying your own CA.
You're correct that some devices may use certificate pinning to prevent me from doing this, but for those devices my solution is simple: They're denied Internet access entirely.
Edit: As a manufacturer/vendor you have zero expectation of privacy from me the consumer. I bought the device, I bought the equipment that runs the network, I pay to keep the device connected to the Internet, I get the final say on which packets your app receives. Any vendor who believes otherwise is mistaken and should be named and shamed.
The irony is that as people justifiably push for "more security", more and more of them are going to use HTTPS or other encrypted transports, making it impossible to determine what information they're transferring just from network inspection.
End-to-end encryption is a good thing only if you trust both endpoints and don't want MITMs to interfere. Otherwise, it's security being used against you.
When these smart device manufacturers "smarten up" and start encrypting everything (likely with no options to disable and/or e.g. install self-signed certificates - naturally, because of "security reasons"), it'll be all-or-nothing.