I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

▲

Ecsta 2 hours ago | parent | next [-]

There's a lot of public keys that don't give you any special access, unless the dev is really bad.

Anyone who cares about security will be using App Attest or the Google store equivalent.

▲

CodesInChaos 6 minutes ago | parent | next [-]

> Anyone who cares about security will be using App Attest or the Google store equivalent.

Why? I rarely have security objectives where remote attention would help, and it has a huge impact on user freedom. For B2C attestation is just an evil captcha.

▲

JTbane 2 hours ago | parent | prev [-]

>Anyone who cares about security

I have something hilarious to tell you about IoT apps

▲

tclancy 2 hours ago | parent | next [-]

A Venn diagram like a 6th grade boy's graffiti of boobs.

▲

cute_boi 7 minutes ago | parent | prev | next [-]

Most of these companies try to penny pinch and give task to hardware engineer. As a result there are lot of security issues with IOT devices.

▲

sophacles 29 minutes ago | parent | prev [-]

The "S" in IoT stands for security!

	▲	yako21000 5 minutes ago \| parent [-]
		That one made me giggle!

▲

tehlike an hour ago | parent | prev | next [-]

Another rule of thumb - i know it's not always the best since some products are really nice aesthetically - is to buy only local smart stuff, for example, zigbee/zwave.

▲

petepete 43 minutes ago | parent [-]

I live by this rule*. Being able to pick up stuff from IKEA that's well supported, well designed and really affordable is a huge advantage.

*almost, I have two things that need an app. My Vaillant boiler and my Yale alarm system. Both apps are terrible, but I have a 10 year warranty on the boiler and my alarm is up to scratch from a home insurance point of view.**

	▲	tehlike 39 minutes ago \| parent [-]
		Yale alarm? Can you link? Vailant boiler - I wonder if there's a debug interface you can use. Not knowing specifics of your model, i foudn this: https://github.com/jayme-github/esphome_vaillant Codex can help probably further heh.

▲

dev_l1x_be 2 hours ago | parent | prev | next [-]

In many cases it is bad to publish this info because they might come after you. There used to be a company who shielded the “researcher” from the legal consequences, can’t remember the name though.

	▲	fragmede an hour ago \| parent [-]
		@stake or L0pht?

▲

inigyou 2 hours ago | parent | prev | next [-]

Everything can be controlled without a proprietary app. Hope you reverse engineer the protocol and publish how to do it.

	▲	tehlike an hour ago \| parent [-]
		Or claude/codex can.

▲

fragmede an hour ago | parent | prev | next [-]

Have you actually tried to do anything with them though? The keys are in there, but may not grant you any real extra access beyond what your user is actually allowed to do via the app.

	▲	avgDev an hour ago \| parent [-]
		It is still pretty nice, you don't have to install yet another app to do something. People did this with Mazda app as it allowed them to start the car without subscription. They 'fixed' it.

▲

inisirex an hour ago | parent | prev [-]

[flagged]