5 ms·

More concerning to me was the fairly recent removal of non-phone-app setup. It used to be that a chromecast would display a 4 character code on screen, which co

by RickS 8y ago

More concerning to me was the fairly recent removal of non-phone-app setup. It used to be that a chromecast would display a 4 character code on screen, which could be used to activate it from the browser. Now, they require that it be managed with the google Home app, and have discontinued the method that allowed chromecast use without installing additional google software on your phone. This made for a really disheartening christmas experience, when I first assured my mother that no, we could skip this stuff with your phone, only to find out that no, she would indeed have to make that sacrifice. Especially frustrating is that my same devices, validated with the old method, continue to function just fine. Does anyone with more knowledge than I have know of a reason for this that isn't data-greedy or consumer-hostile? From my perspective, "Don't be evil" has been dead long enough that the bones are sunbleached.

05 8y ago
The obvious reason is that any local browser config pages cannot be SSL protected because the device can not provide a valid certificate for 192.168.0.33 or chromecast.local Phone app can use a custom TLS CA to make sure the stick was produced by Google and is not a rogue neighbor phishing for your WiFi password..
- djrogers 8y ago
  No, that's not how it worked - you got a code on the screen you could use to activate the device with google from any browser - much like many many many TV apps use (visit foo.com/activate and enter code NNNN). You weren't browsing to any local devices...
  - dragonwriter 8y ago
    > No, that's not how it worked Yes, it is; Chromecast activation has always used the Chromecast itself as the WiFi host; you have to do that to even set it up to use another network. > you got a code on the screen you could use to activate the device with google from any browser - much like many many many TV apps use (visit foo.com/activate and enter code NNNN). TV apps can do that because the TV device is already configured to connect to a network. And both the app and your browser can connect to the same remote server. Chromecast activation can't work that way, since it occurs as a necessary prerequisite to connecting the Chromecast to a network.
    - RickS 8y ago
      (OP of complaint) This matches my understanding as well. 05's answer about security and rogue devices is a good one. It makes a lot of sense. For my (and I expect most people's) threat model, google's prying eyes are a more credible concern than my neighbor's, and I wish they hadn't changed it, but it's nonetheless a defensible reason for making the change.
  - TravisDick 8y ago
    I'm a little confused by this. If the chromecast didn't know my wifi password, how could it connect to google to receive any information / configuration? Mostly commenting because I want to know if there's some cool mechanism for getting around that! Thanks!
- RickS 8y ago
  Thank you for this answer. It makes a lot of sense. For my (and I expect most people's) threat model, google's prying eyes are a more credible concern than my neighbor's, and I wish they hadn't changed it, but it's nonetheless a defensible reason for making the change.
  - johncolanduoni 8y ago
    > For my (and I expect most people's) threat model, google's prying eyes are a more credible concern than my neighbor's, and I wish they hadn't changed it, but it's nonetheless a defensible reason for making the change. Phishing by a random bad actor taking advantage of lack of TLS verification is far more likely than Google putting a sandbox escape in a phone app they distribute to steal information from you. I really hope most people's threat model doesn't match yours in this respect.
- tinus_hn 8y ago
  It is impossible to ‘make sure the stick was produced by Google’. That’s fake security which is even worse than no security.
Silhouette 8y ago
As an extra treat, Google Home isn't compatible with some older devices that are still perfectly functional. We use a Gen 3 iPad (max iOS version = 9) to control a few bits and pieces, including being a handy way to cast online streaming services to the big screen. Until one day the Chromecast gets a bit confused, as they do from time to time... and the Chromecast app on the iPad tells us in nauseatingly cutesy fashion that we should get the latest version... and redirects us to a different app on the App Store (Google Home) that isn't even compatible with our device. Literally, one day it all worked fine, the next day the whole setup is completely broken.
- scarface74 8y ago
  In the meantime, my first gen iPad from 2010 running iOS 5 can Airplay to my AppleTV 4K....
pishpash 8y ago
Everybody could foresee "don't be evil" would die with the IPO. Not only that, but the spirit of young Google, like 20% time or Google Labs and off-the-wall ideas that could bubble up, all eventually died.
- jonny_eh 8y ago
  Requiring a phone for setup now counts as evil?
  - justinclift 8y ago
    Some people (like me) don't do phones. ;) But then again, I de-Googled myself ages ago, so mostly not a problem.

by RickS 8y ago

05 8y ago

The obvious reason is that any local browser config pages cannot be SSL protected because the device can not provide a valid certificate for 192.168.0.33 or chromecast.local Phone app can use a custom TLS CA to make sure the stick was produced by Google and is not a rogue neighbor phishing for your WiFi password..

djrogers 8y ago
No, that's not how it worked - you got a code on the screen you could use to activate the device with google from any browser - much like many many many TV apps use (visit foo.com/activate and enter code NNNN). You weren't browsing to any local devices...
- dragonwriter 8y ago
  > No, that's not how it worked Yes, it is; Chromecast activation has always used the Chromecast itself as the WiFi host; you have to do that to even set it up to use another network. > you got a code on the screen you could use to activate the device with google from any browser - much like many many many TV apps use (visit foo.com/activate and enter code NNNN). TV apps can do that because the TV device is already configured to connect to a network. And both the app and your browser can connect to the same remote server. Chromecast activation can't work that way, since it occurs as a necessary prerequisite to connecting the Chromecast to a network.
  - RickS 8y ago
    (OP of complaint) This matches my understanding as well. 05's answer about security and rogue devices is a good one. It makes a lot of sense. For my (and I expect most people's) threat model, google's prying eyes are a more credible concern than my neighbor's, and I wish they hadn't changed it, but it's nonetheless a defensible reason for making the change.
- TravisDick 8y ago
  I'm a little confused by this. If the chromecast didn't know my wifi password, how could it connect to google to receive any information / configuration? Mostly commenting because I want to know if there's some cool mechanism for getting around that! Thanks!
RickS 8y ago
Thank you for this answer. It makes a lot of sense. For my (and I expect most people's) threat model, google's prying eyes are a more credible concern than my neighbor's, and I wish they hadn't changed it, but it's nonetheless a defensible reason for making the change.
- johncolanduoni 8y ago
  > For my (and I expect most people's) threat model, google's prying eyes are a more credible concern than my neighbor's, and I wish they hadn't changed it, but it's nonetheless a defensible reason for making the change. Phishing by a random bad actor taking advantage of lack of TLS verification is far more likely than Google putting a sandbox escape in a phone app they distribute to steal information from you. I really hope most people's threat model doesn't match yours in this respect.
tinus_hn 8y ago
It is impossible to ‘make sure the stick was produced by Google’. That’s fake security which is even worse than no security.

Silhouette 8y ago

As an extra treat, Google Home isn't compatible with some older devices that are still perfectly functional. We use a Gen 3 iPad (max iOS version = 9) to control a few bits and pieces, including being a handy way to cast online streaming services to the big screen. Until one day the Chromecast gets a bit confused, as they do from time to time... and the Chromecast app on the iPad tells us in nauseatingly cutesy fashion that we should get the latest version... and redirects us to a different app on the App Store (Google Home) that isn't even compatible with our device. Literally, one day it all worked fine, the next day the whole setup is completely broken.

scarface74 8y ago
In the meantime, my first gen iPad from 2010 running iOS 5 can Airplay to my AppleTV 4K....

pishpash 8y ago

Everybody could foresee "don't be evil" would die with the IPO. Not only that, but the spirit of young Google, like 20% time or Google Labs and off-the-wall ideas that could bubble up, all eventually died.

jonny_eh 8y ago
Requiring a phone for setup now counts as evil?
- justinclift 8y ago
  Some people (like me) don't do phones. ;) But then again, I de-Googled myself ages ago, so mostly not a problem.