[kjellsbells]

I'm strangely comforted by the fact that OP had to work so hard to get in.

I was expecting that the pin software would be IoT-standard terrible, so it was a pleasant surprise to see that the Humane team did their best to use SELinux and lock it down.

No knock on them for not getting it 100% right here, and besides, it's always been the case that once an attacker has physical access they will eventually get in.

[philipwhiuk]

Using a vulnerability not found until after the software stopped being maintained feels a bit like cheating :)

[agg23]

It would, but the vulnerability was found and patched in mainline Android a few months after the device came out, but with over half a year until support was dropped. We obviously can't expect them to have kept the OS up to date, especially given the pressure they were under, but applying security patches seems very reasonable.

[agg23]

I definitely agree. Humane cared about physical device security a lot and it really shows with how they built out the firmware.

[jkestner]

Best of all, their security through obscurity.

[vayup]

Me too. Kudos to the team.