Absolutely wild. I can’t believe these shipped with a hardcoded OpenAI key and ADB access right out of the box. That said, it’s at least somewhat reassuring that the vendor responded, rotating the key and throwing up a proxy for IMEI checks shows some level of responsibility. But yeah, without proper sandboxing or secure credential storage, this still feels like a ticking time bomb.

▲

hn_throwaway_99 2 days ago | parent | next [-]

> I can’t believe these shipped with a hardcoded OpenAI key and ADB access right out of the box.

As someone with a lot of experience in the mobile app space, and tangentially in the IoT space, I can most definitely believe this, and I am not surprised in the slightest.

Our industry may "move fast", but we also "break things" frequently and don't have nearly the engineering rigor found in other domains.

▲

rvnx 2 days ago | parent [-]

It was a good thing for user privacy that the keys were directly on the device, it is only in DAN mode that a copy of the chats were sent.

So eventually if they remove the keys from the device, messages will have to go through their servers instead.

▲

hn_throwaway_99 a day ago | parent [-]

> It was a good thing for user privacy that the keys were directly on the device

You want to think through that one again? With the OpenAI key on device it means anyone could use that key to call (and bill) OpenAI's APIs. It's absolutely not feasible to ship the OpenAI keys on device.

▲

rvnx a day ago | parent | next [-]

Sounds good to me, the company I purchased the device from, takes the risk, instead of putting my own privacy at risk. Sounds like a good deal.

	▲	hn_throwaway_99 a day ago \| parent [-]
		This is not a serious argument.

▲

gg-plz 17 hours ago | parent | prev [-]

[dead]

▲

lucasluitjes 2 days ago | parent | prev | next [-]

Hardcoded API keys and poorly secured backend endpoints are surprisingly common in mobile apps. Sort of like how common XSS/SQLi used to be in webapps. Decompiling an APK seems to be a slightly higher barrier than opening up devtools, so they get less attention.

Since debugging hardware is an even higher threshold, I would expect hardware devices this to be wildly insecure unless there are strong incentive for investing in security. Same as the "security" of the average IoT device.

▲

bigiain 2 days ago | parent [-]

Eventually someone is going to get a bill for the OpenAPI key usage. That will provide some incentive. (Incentive to just rotate the key and brick all the devices rather than fix the problem, most likely.

▲

eru 2 days ago | parent [-]

> (Incentive to just rotate the key and brick all the devices rather than fix the problem, most likely.

But that at least turns it into something customers will notice. And companies already have existing incentives for dealing with that.

▲

bigiain 2 days ago | parent [-]

At that stage you just rotate the company name or branding...

▲

eru 2 days ago | parent [-]

Sure. But then you cannot benefit from building up a good reputation and charge people extra for it.

(There's a reason Apple can charge crazy markups.)

▲

bigiain 21 hours ago | parent [-]

Had you ever heard of IKKO before this? I hadn't, and I'm at least adjacent to the hifi and audio nerd crowd.

Apple have a reputation and brand that allows them to charge premium prices.

IKKO seems, at least to me, to be effectively a disposable brand. If their reputation goes bad, their only reals costs are setting up a new website/AliExpress Store/Amazon seller account.

	▲	eru 18 hours ago \| parent [-]
		To expand on what I was trying to say: Yes, you can run with disposable brands. It's a perfectly viable business strategy in many cases. However: if you do that you are missing out on the benefits of building a good reputation. Even in the cases, where your product _is_ actually good. So another perfectly valid business strategy is to build a longer lasting brand. Like Apple has done. (Or countless other companies.) In most markets we see both kinds of strategies at play. As a customer, you can usually decide which kind of strategy you give your money to.

▲

anitil 2 days ago | parent | prev | next [-]

The IOT and embedded space is simultaneously obsessed with IP protection, fuse protecting code etc, and incapable of managing the life cycle of secrets. I worked at one company that actually did it well on-device, but neglected they had to ship their testing setup overseas including certain keys. So even if you couldn't break in to the device you could 'acquire' one of the testing devices and have at it

▲

switchbak 2 days ago | parent | prev [-]

I think we'll see plenty of this as the wave of vibe-coded apps starts rolling in.