> Why? What security benefit do you gain by using HTTPS when you already check the signature/hash of the firmware file? B/c without HTTPS you can't verify you'

> Why? What security benefit do you gain by using HTTPS when you already check the signature/hash of the firmware file? B/c without HTTPS you can't verify you're actually talking to IKEA's update servers. Even if there's firmware signature implemented an attacker could still MITM you over HTTP and simply not serve you a file with updates. Which means that they can prevent your devices from upgrading, i.e to receive an update that closes a known flaw they might be exploiting.