3 ms·
> The third is inexcusable, yes It depends what exactly the keys are used for. If it's just for secure communication between the app and the bulb, and the keys
by fyfy18 8y ago
> The third is inexcusable, yes
It depends what exactly the keys are used for. If it's just for secure communication between the app and the bulb, and the keys are different for each bulb, I don't see any issue with this.
- dmitrygr 8y agoIncluding private keys of any sort in the firmware is kind of a no no
- alanfranzoni 8y agoNot necessarily, if the private key is different for every device. What would you have done instead?
- dmitrygr 8y agoseems to be the same in all bulbs :(
- jon-wood 8y agoYou need some way for the device to communicate with your backend, and private keys work pretty well. For the devices I work on these keys are unique for each device, and transferred over to it during the setup process.
- stefan_ 8y agoProvisioning each device with a unique certificate signed by a vendor CA is what I would call absolute best practice. It's possible this certificate isn't that and is instead reused across all bulbs. We don't know that. And even if that is the case, there are no details on what this certificate is even used for that would allow us to determine if this is any sort of security problem.