[IshKebab]

Except... that pairing in Bluetooth 4.2 is still broken. And they apparently even used an algorithm from Bluetooth 2 that was known to be broken.

https://pomcor.com/2015/06/03/has-bluetooth-become-secure/

Basically Passkey Entry is broken so eavesdroppers can trivially learn the PIN. You must use a dynamic PIN (not always possible).

Oh and if you're thinking you can implement your own pairing method that is actually secure, via the Out-of-Band method, think again! Neither Android nor iOS support it.

[gman99]

>Neither Android nor iOS support [pairing ... via the Out-of-Band method].

I'm not sure this is actually true (unless you're talking about bugs with individual manufacturers implementation on Android?). Both iOS and Android support SSP with OOB key exchange via NFC.

There are lots of products that have been available that use this for pairing/connecting, eg: https://www.bose.com/en_us/support/article/pairing-a-device-...

[IshKebab]

Android supports OOB via NFC, but only as a special case. You should just be able to call `createBondOutOfBand()` but the method is hidden:

https://android.googlesource.com/platform/frameworks/base.gi...

I'm pretty sure iOS doesn't support pairing via NFC.

https://www.linkedin.com/pulse/nfc-speakers-from-apple-you-c...

http://www.informationweek.com/mobile/mobile-business/iphone...

So, no, they don't support OOB (except in one limited case on Android).