7 ms·

I got new boilers (furnaces for radiator heating) installed recently, and halfway through one of the crew asked where they should install the boxes that connect

I got new boilers (furnaces for radiator heating) installed recently, and halfway through one of the crew asked where they should install the boxes that connect the thermostats to the internet. Luckily they were completely separate, so I said I never agreed with that and they left them boxed up, because they had never thought to mention it. (They listened to my explanation that I would not have something that literally starts a fire in my house connected to the internet without at least being able to control the software it runs, but I think they were just being polite.)

theonealtair 5y ago
I went to use the app for my hot tub and put in the 6 digit pin, except the last number I put in was a 4 instead of a 3. It logged me in, but the temperature looked off, then I realized I wasn’t connected to my hot tub, it was someone else. Turns out the 6-digit pins are sequential. And this is from a billion dollar pool company.
- JoeyBananas 5y ago
  That's incredible
  - theonealtair 5y ago
    The temp said 20° (which is impossible in my climate). Good thing I didn’t crank the heat up.
- bombcar 5y ago
  This is true across a frighteningly large swath of “quasi industrial home control” stuff - all the vulnerabilities of industrial controls with zero of the attention paid to it.
  - conk 5y ago
    What’s industrial home control?
    - bombcar 5y ago
      All the commercial stuff from before the Apple Home craze. Automated sprinklers, lighting, controls. It’s been out there since the 70s and got rudimentary internet access early on - and lots of it is very slapdash (underlying assumptions that everything is local wire or low range radio from before internet was slapped on).
- TheCoelacanth 5y ago
  The S in IOT stands for security.
- Mountain_Skies 5y ago
  My neighbor has never properly setup the internet connection on his hot tub. It's still in access point mode, waiting for anyone to connect and take control of it. Going to guess that it at least has manual controls on the hot tub itself. If he wasn't such a difficult curmudgeon to talk to, I'd warn him about it, but he'll probably just think I'm trying to sell him something.
assttoasstmgr 5y ago
I mean you do realize a Wi-Fi connected thermostat just closes a pair of contacts that tell the boiler "heat on" or "heat off" and it's not "literally starting a fire" in your house. Assuming someone took over and had full control of your thermostat the worst they could do is turn the heat on and make you uncomfortable. All boilers/furnaces/etc have protection mechanisms built in and in no circumstance is the 'fire' controlled by the thermostat whatsoever. A thermostat simply sends a signal that 'calls' for heat or cooling. The only exception would be a mains-voltage thermostat that controls an electric wall heater but I've never seen those connected to Wi-Fi.
- jdavis703 5y ago
  Correct, this is totally different than having a smart gas oven or stove. I too would never have plumbing or gas appliances hooked up to the internet. But my Nest thermostat is totally safe.
  - assttoasstmgr 5y ago
    Whirlpool figured this out and deserves some praise here. All their new appliances that support Wi-Fi connectivity have a physical "Remote Enable" button that you must manually push every cycle to enable remote control of the device through the app. You cannot start the oven/washer/etc remotely unless someone has manually acknowledged it at the appliance and I believe it resets after 24 hours or when the cycle is complete.
    - jay_kyburz 5y ago
      I bet its all software though.
      - WalterBright 5y ago
        Of course, and it's remotely upgradable, too. That way, the manufacturer can install spyware anytime they want, and any hacker can use it to mine bitcoins.
13of40 5y ago
A year or two ago, my newish car was at the shop, recovering from a fender bender, and I got a call from the police asking where it was. I told them and they said that matched with the coordinates they had. It turned out that the SOS system had malfunctioned, and the GPS and integrated 4g (which I didn't even know I had, because the car doesn't have a built in navigation system or voice phone) had been phoning home and telling the car company I was in trouble. I called the manufacturer and asked if I had a subscription to this service, and I was informed that the car had a subscription, and I couldn't cancel it. Luckily I appealed to the dealership and after a couple of days the sent me a "confidential" pdf with instructions on how to unplug the spy module...which of course threw up all kinds of scary warnings starting the car after that... until it suddenly didn't anymore. So now I have a dumb car, and I love it more than ever.
- toss1 5y ago
  May I ask what kind of car that was, and what country?
  - vetinari 5y ago
    AFAIK the SOS system is mandatory in any new car sold in EU since 31.3.2018.
    - car_analogy 5y ago
- megablast 5y ago
  Good. Every car needs to be tracked at all times. They are death machines, responsible for over s million deaths worldwide every year. It is insane we allow this.
  - smegger001 5y ago
    so are knives but i don't think my folding pocket knife needs gps tracker built in
chris_st 5y ago
We had a water heater installed a few years ago, that along with a heat exchanger heats the house, so it comes with a thermostat. Salesman tells me in glowing terms about the WiFi-enabled thermostat they're "giving" me, to which I reply "ABSOLUTELY NOT"... turns out they have an old-style one that's $300 cheaper, and... has worked fine for the entire time, without poking a severe security hole in my WiFi network.
KennyBlanken 5y ago
They were being polite, as all service workers have to be. Tell me you've never worked s service industry job without telling me you've never worked a service industry job.... There are numerous safety interlocks in gas furnaces ranging from flame presence sensors to (usually) several heat limit switches, often which are wired directly in line between the gas solenoid and the furnace controller. The controller's logic has a lot of "expect this condition by this amount of time" rules, too. The furnace's controller is usually separate from the system controller (the box that talks to thermostats, valves/dampers, pumps, etc.) On forced hot air systems that are new enough, the furnace and system controller monitor outlet air temperature and shut down if it's too hot. Gas furnaces are incredibly safe. Also, the quote to install the system specified what thermostats they were going to install. It's on you to read the quote, not to get uppity at service personnel and lecture them people haxx0ring your furnace.

theonealtair 5y ago

I went to use the app for my hot tub and put in the 6 digit pin, except the last number I put in was a 4 instead of a 3. It logged me in, but the temperature looked off, then I realized I wasn’t connected to my hot tub, it was someone else. Turns out the 6-digit pins are sequential. And this is from a billion dollar pool company.

JoeyBananas 5y ago
That's incredible
- theonealtair 5y ago
  The temp said 20° (which is impossible in my climate). Good thing I didn’t crank the heat up.
bombcar 5y ago
This is true across a frighteningly large swath of “quasi industrial home control” stuff - all the vulnerabilities of industrial controls with zero of the attention paid to it.
- conk 5y ago
  What’s industrial home control?
  - bombcar 5y ago
    All the commercial stuff from before the Apple Home craze. Automated sprinklers, lighting, controls. It’s been out there since the 70s and got rudimentary internet access early on - and lots of it is very slapdash (underlying assumptions that everything is local wire or low range radio from before internet was slapped on).
TheCoelacanth 5y ago
The S in IOT stands for security.
Mountain_Skies 5y ago
My neighbor has never properly setup the internet connection on his hot tub. It's still in access point mode, waiting for anyone to connect and take control of it. Going to guess that it at least has manual controls on the hot tub itself. If he wasn't such a difficult curmudgeon to talk to, I'd warn him about it, but he'll probably just think I'm trying to sell him something.

assttoasstmgr 5y ago

I mean you do realize a Wi-Fi connected thermostat just closes a pair of contacts that tell the boiler "heat on" or "heat off" and it's not "literally starting a fire" in your house. Assuming someone took over and had full control of your thermostat the worst they could do is turn the heat on and make you uncomfortable. All boilers/furnaces/etc have protection mechanisms built in and in no circumstance is the 'fire' controlled by the thermostat whatsoever. A thermostat simply sends a signal that 'calls' for heat or cooling. The only exception would be a mains-voltage thermostat that controls an electric wall heater but I've never seen those connected to Wi-Fi.

jdavis703 5y ago
Correct, this is totally different than having a smart gas oven or stove. I too would never have plumbing or gas appliances hooked up to the internet. But my Nest thermostat is totally safe.
- assttoasstmgr 5y ago
  Whirlpool figured this out and deserves some praise here. All their new appliances that support Wi-Fi connectivity have a physical "Remote Enable" button that you must manually push every cycle to enable remote control of the device through the app. You cannot start the oven/washer/etc remotely unless someone has manually acknowledged it at the appliance and I believe it resets after 24 hours or when the cycle is complete.
  - jay_kyburz 5y ago
    I bet its all software though.
    - WalterBright 5y ago
      Of course, and it's remotely upgradable, too. That way, the manufacturer can install spyware anytime they want, and any hacker can use it to mine bitcoins.

13of40 5y ago

A year or two ago, my newish car was at the shop, recovering from a fender bender, and I got a call from the police asking where it was. I told them and they said that matched with the coordinates they had. It turned out that the SOS system had malfunctioned, and the GPS and integrated 4g (which I didn't even know I had, because the car doesn't have a built in navigation system or voice phone) had been phoning home and telling the car company I was in trouble. I called the manufacturer and asked if I had a subscription to this service, and I was informed that the car had a subscription, and I couldn't cancel it. Luckily I appealed to the dealership and after a couple of days the sent me a "confidential" pdf with instructions on how to unplug the spy module...which of course threw up all kinds of scary warnings starting the car after that... until it suddenly didn't anymore. So now I have a dumb car, and I love it more than ever.

toss1 5y ago
May I ask what kind of car that was, and what country?
- vetinari 5y ago
  AFAIK the SOS system is mandatory in any new car sold in EU since 31.3.2018.
  - car_analogy 5y ago
megablast 5y ago
Good. Every car needs to be tracked at all times. They are death machines, responsible for over s million deaths worldwide every year. It is insane we allow this.
- smegger001 5y ago
  so are knives but i don't think my folding pocket knife needs gps tracker built in

chris_st 5y ago

We had a water heater installed a few years ago, that along with a heat exchanger heats the house, so it comes with a thermostat. Salesman tells me in glowing terms about the WiFi-enabled thermostat they're "giving" me, to which I reply "ABSOLUTELY NOT"... turns out they have an old-style one that's $300 cheaper, and... has worked fine for the entire time, without poking a severe security hole in my WiFi network.

KennyBlanken 5y ago

They were being polite, as all service workers have to be. Tell me you've never worked s service industry job without telling me you've never worked a service industry job.... There are numerous safety interlocks in gas furnaces ranging from flame presence sensors to (usually) several heat limit switches, often which are wired directly in line between the gas solenoid and the furnace controller. The controller's logic has a lot of "expect this condition by this amount of time" rules, too. The furnace's controller is usually separate from the system controller (the box that talks to thermostats, valves/dampers, pumps, etc.) On forced hot air systems that are new enough, the furnace and system controller monitor outlet air temperature and shut down if it's too hot. Gas furnaces are incredibly safe. Also, the quote to install the system specified what thermostats they were going to install. It's on you to read the quote, not to get uppity at service personnel and lecture them people haxx0ring your furnace.