[whalesalad]

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

[Ecsta]

There's a lot of public keys that don't give you any special access, unless the dev is really bad.

Anyone who cares about security will be using App Attest or the Google store equivalent.

[JTbane]

>Anyone who cares about security

I have something hilarious to tell you about IoT apps

[tclancy]

A Venn diagram like a 6th grade boy's graffiti of boobs.

[dhosek]

Just as a pedantic aside, people often use Venn diagram when they mean Euler diagram. A Venn diagram always has the overlapping circles and use shading or labeling describe the set relation. Euler diagrams let the circles describe the relation so two non intersecting sets in a Venn diagram might share the left circle green, the right blue and leave the intersection blank or grey. An Euler diagram will have two disjoint circles.

[tclancy]

A. I love a pedantic aside

B. I love that Euler is pronounced “oiler” which is North American slang for a drunk. I’ve been trying to find that constant my whole adult life.

[dhosek]

I learned the correct pronunciation when someone laughed at me at a TeX conference in the 80s when I made a reference to the You-ler fonts. In my single semester of high school German I was either never taught or ignored the teacher when the pronunciation of eu was given (or perhaps I just never connected it with Euler).

[sophacles]

The "S" in IoT stands for security!

[yako21000]

That one made me giggle!

[cute_boi]

Most of these companies try to penny pinch and give task to hardware engineer. As a result there are lot of security issues with IOT devices.

[CodesInChaos]

> Anyone who cares about security will be using App Attest or the Google store equivalent.

Why? I rarely have security objectives where remote attention would help, and it has a huge impact on user freedom. For B2C attestation is just an evil captcha.

[fragmede]

Have you actually tried to do anything with them though? The keys are in there, but may not grant you any real extra access beyond what your user is actually allowed to do via the app.

[avgDev]

It is still pretty nice, you don't have to install yet another app to do something. People did this with Mazda app as it allowed them to start the car without subscription. They 'fixed' it.

[tehlike]

Another rule of thumb - i know it's not always the best since some products are really nice aesthetically - is to buy only local smart stuff, for example, zigbee/zwave.

[petepete]

I live by this rule*. Being able to pick up stuff from IKEA that's well supported, well designed and really affordable is a huge advantage.

*almost, I have two things that need an app. My Vaillant boiler and my Yale alarm system. Both apps are terrible, but I have a 10 year warranty on the boiler and my alarm is up to scratch from a home insurance point of view.**

[tehlike]

Yale alarm? Can you link?

Vailant boiler - I wonder if there's a debug interface you can use. Not knowing specifics of your model, i foudn this: https://github.com/jayme-github/esphome_vaillant

Codex can help probably further heh.

[petepete]

It's a Yale Sync

https://yalehome.co.uk/yale-sync-hub

It's not really something I want 'home rolled', I just want it to work.

Same goes for the boiler really. If it stops working I can phone Valliant and they'll send someone round to fix it.

[zrobotics]

Ugh, that's a new low. I can't think of a single good reason a lighting app would need shopify api access.

That said, I've done some consulting work on shopify stores, and I wouldn't be shocked at all to see something like that at all. The bar for code quality that a lot of low end consultants/designers deliver is just abysmal.

[dev_l1x_be]

In many cases it is bad to publish this info because they might come after you. There used to be a company who shielded the “researcher” from the legal consequences, can’t remember the name though.

[fragmede]

@stake or L0pht?

[vhiremath4]

What lights did you get? I have Oasis. Love them but same thing would rather control them through a central bot or something.

[inigyou]

Everything can be controlled without a proprietary app. Hope you reverse engineer the protocol and publish how to do it.

[tehlike]

Or claude/codex can.