4 ms·

> what was the issue with not connecting it to WiFi in the first place? Like many other 'smart' appliances, it creates it's own AP so allow you to set it up. S

> what was the issue with not connecting it to WiFi in the first place? Like many other 'smart' appliances, it creates it's own AP so allow you to set it up. So anyone within range could attach it to their network, and then do whatever they like with it. > surely the fact that it has WiFi was known at purchase time? It came with the place they're living in. Someone else made that decision.

gambiting 4y ago
Is the AP active literally all the time until you set it up? Usually in these devices it only activates once you select an option in the menu, or shortly after first start - but yeah, if it's on 24/7 until configured, then I agree that's a problem.
- paranoidrobot 4y ago
  I don't know, I don't have the device. I do have a Samsung TV, and no matter what I do, I can't turn off the Wifi/Bluetooth radios in it - and several of my neighbours keep trying to connect to it. The Google Chromecasts continually broadcast their AP when not fully set up. A neighbour has a bluetooth/wifi speaker that pushed some kind of "Do you want to set up your X brand speaker now?" prompt to my phone. There's a few other smart devices near me that are also broadcasting open APs that never seem to go away.
kergonath 4y ago
> It came with the place they're living in. Someone else made that decision. It is irrelevant anyway. Buying something with the intent of modding it is not that unreasonable.
moolcool 4y ago
> Like many other 'smart' appliances, it creates it's own AP so allow you to set it up. So anyone within range could attach it to their network, and then do whatever they like with it. Considering the security risk of smart devices generally working like this, I feel like the industry ought to standardize on something more sensible. Maybe some kind of NFC pairing?
- yrro 4y ago
  It's called WPS. God knows why manufacturers prefer to do something as iduotic as crearing their own WiFi access point rather than using it!
  - Dylan16807 4y ago
    WPS is severely broken and insecure. And the QR/NFC thing they added to replace it will require quite new devices.
    - yrro 4y ago
      WPS PIN method is severely broken and insecure, absolutely typical of most stuff put out by the Wi-Fi Alliance. As far as I know, WPS push button method is fine. I haven't ever needed or wanted to try to use the NFC method, I would disable it on any equipment I installed until I had a need for it. And even then I would do some research to see how badly the Wi-Fi Alliance fucked it up before making a judgement about whether I would feel comfortable enabling it.
  - Crosseye_Jack 4y ago
    Depending on the router manufacturer you may not be able to disable WPS pin and keep WPS push button (this is the case of the router that was supplied by my ISP as it comes with a rather dumbed down UI, not sure if I could disable it via editing a settings backup file and applying that back to the router as I use my own equipment, but most consumers will just use the router issued to them from their ISP). WPS enter pin has a max number of possibilities of 11k pins (it checks the pin in 2 half’s and the last digit is a check digit, so 10k possibilities for the first half and 999 possibilities for the 2nd half), and some routers don’t rate limit the connection requests. Some router manufacturers fixed the issue by removing WPS pin, others “fixed” it by rate limiting WPS pin connection attempts, but that will just delay the attack. So we are left with WPS Push button (if that’s available because as stated above, consumer routers may only allow disabling WPS completely rather than just disable WPS pin). But thats a bit of a pain for items like Shellys that are designed to be put behind fixtures. But yeah, in the case of a fridge and most other consumer grade equipment putting a push button somewhere for WPS Push Button should be easy to factor in.

gambiting 4y ago

Is the AP active literally all the time until you set it up? Usually in these devices it only activates once you select an option in the menu, or shortly after first start - but yeah, if it's on 24/7 until configured, then I agree that's a problem.

paranoidrobot 4y ago
I don't know, I don't have the device. I do have a Samsung TV, and no matter what I do, I can't turn off the Wifi/Bluetooth radios in it - and several of my neighbours keep trying to connect to it. The Google Chromecasts continually broadcast their AP when not fully set up. A neighbour has a bluetooth/wifi speaker that pushed some kind of "Do you want to set up your X brand speaker now?" prompt to my phone. There's a few other smart devices near me that are also broadcasting open APs that never seem to go away.

kergonath 4y ago

> It came with the place they're living in. Someone else made that decision. It is irrelevant anyway. Buying something with the intent of modding it is not that unreasonable.

moolcool 4y ago

> Like many other 'smart' appliances, it creates it's own AP so allow you to set it up. So anyone within range could attach it to their network, and then do whatever they like with it. Considering the security risk of smart devices generally working like this, I feel like the industry ought to standardize on something more sensible. Maybe some kind of NFC pairing?

yrro 4y ago
It's called WPS. God knows why manufacturers prefer to do something as iduotic as crearing their own WiFi access point rather than using it!
- Dylan16807 4y ago
  WPS is severely broken and insecure. And the QR/NFC thing they added to replace it will require quite new devices.
  - yrro 4y ago
    WPS PIN method is severely broken and insecure, absolutely typical of most stuff put out by the Wi-Fi Alliance. As far as I know, WPS push button method is fine. I haven't ever needed or wanted to try to use the NFC method, I would disable it on any equipment I installed until I had a need for it. And even then I would do some research to see how badly the Wi-Fi Alliance fucked it up before making a judgement about whether I would feel comfortable enabling it.
- Crosseye_Jack 4y ago
  Depending on the router manufacturer you may not be able to disable WPS pin and keep WPS push button (this is the case of the router that was supplied by my ISP as it comes with a rather dumbed down UI, not sure if I could disable it via editing a settings backup file and applying that back to the router as I use my own equipment, but most consumers will just use the router issued to them from their ISP). WPS enter pin has a max number of possibilities of 11k pins (it checks the pin in 2 half’s and the last digit is a check digit, so 10k possibilities for the first half and 999 possibilities for the 2nd half), and some routers don’t rate limit the connection requests. Some router manufacturers fixed the issue by removing WPS pin, others “fixed” it by rate limiting WPS pin connection attempts, but that will just delay the attack. So we are left with WPS Push button (if that’s available because as stated above, consumer routers may only allow disabling WPS completely rather than just disable WPS pin). But thats a bit of a pain for items like Shellys that are designed to be put behind fixtures. But yeah, in the case of a fridge and most other consumer grade equipment putting a push button somewhere for WPS Push Button should be easy to factor in.