5 ms·

This doesn't seem like a mistake, so much as a decision to assume the LAN is secure. It's a trade off that favors features over security. Which does seem rather

This doesn't seem like a mistake, so much as a decision to assume the LAN is secure. It's a trade off that favors features over security. Which does seem rather "un-Googly" though... If it's unauthenticated, apps/devices/services can easily integrate with it. If it is authenticated, how? Pre-shared API key? How do you initially generate and distribute that API key? How do you access it? Now you need to encrypt that key when you use it. TLS? Great, now you need a TLS certificate that has to be trusted, updated, etc. All solvable problems for sure, but at the cost of complexity, ease of integration, etc.

izacus 8y ago
At the end of the day this is a cast device which will advertise it's presence to the whole network white active and allow anyone to send media to it (and mirror screen to Chromecasts, which have the same API exposed as the author says). Of course, the fact that you can't lock down Chromecast on a local network is a feature that could be very useful.
harshreality 8y ago
How is this difficult? "This is the first time you are using this phone to modify the settings of your google appliance. Please locate your google device, and press <some button>, or tap the microphone firmly, to confirm your intent to trust this phone."
- throwawaymath 8y ago
  I would hate that.
- bradstewart 8y ago
  It's not super difficult, particularly when the other end is a Google-provided app on a smartphone. It gets more complicated with things like Home Assistant[0] or other automation software. Amazon made the decision to force all Echo integrations to go through the internet. [0] https://www.home-assistant.io/ https://www.home-assistant.io/
- ledriveby 8y ago
  Some services use ultrasonic pairing, like (IIRC) Google Play Movies on Roku.
deleted 8y ago
[deleted]
Derek_MK 8y ago
> It's a trade off that favors features over security. I'd say it's moreso a trade off that favors "getting it out the door quickly" over security. It's reasonable that, if you want your app to integrate with a Google Home, you should expect it to be authenticated. Plus, the fact that this API is undocumented seems indicative that 3rd-party integration wasn't the purpose.
jiveturkey 8y ago
my understanding from a very good source is that the team that created Home is indeed not googley, not security focused, and in general not the best of the best. an enormous amount of money was spent to develop it and (being in an ultra competitive field) is a big money loser. the original reason for it was to be an iot hub, which still has not really been realized.

izacus 8y ago

At the end of the day this is a cast device which will advertise it's presence to the whole network white active and allow anyone to send media to it (and mirror screen to Chromecasts, which have the same API exposed as the author says). Of course, the fact that you can't lock down Chromecast on a local network is a feature that could be very useful.

harshreality 8y ago

How is this difficult? "This is the first time you are using this phone to modify the settings of your google appliance. Please locate your google device, and press <some button>, or tap the microphone firmly, to confirm your intent to trust this phone."

throwawaymath 8y ago
I would hate that.
bradstewart 8y ago
It's not super difficult, particularly when the other end is a Google-provided app on a smartphone. It gets more complicated with things like Home Assistant[0] or other automation software. Amazon made the decision to force all Echo integrations to go through the internet. [0] https://www.home-assistant.io/ https://www.home-assistant.io/
ledriveby 8y ago
Some services use ultrasonic pairing, like (IIRC) Google Play Movies on Roku.

deleted 8y ago

[deleted]

Derek_MK 8y ago

> It's a trade off that favors features over security. I'd say it's moreso a trade off that favors "getting it out the door quickly" over security. It's reasonable that, if you want your app to integrate with a Google Home, you should expect it to be authenticated. Plus, the fact that this API is undocumented seems indicative that 3rd-party integration wasn't the purpose.

jiveturkey 8y ago

my understanding from a very good source is that the team that created Home is indeed not googley, not security focused, and in general not the best of the best. an enormous amount of money was spent to develop it and (being in an ultra competitive field) is a big money loser. the original reason for it was to be an iot hub, which still has not really been realized.