6 ms·

I would be worried about putting anything Xiaomi into my home. They have repeatedly proven to be a major privacy concern. Maybe security concern as well.

andylynch 3y ago
That is a valid concern, but not such an issue with Zigbee stuff since you can run it with your own hub giving the sensors 0 external connectivity.
orphea 3y ago
Their sensors are fine, just use a non-Xiaomi hub like SONOFF Zigbee 3.0 USB Dongle.
- NicoJuicy 3y ago
  Sonoff is chinese, doesn't fix the security issue
  - blacksmith_tb 3y ago
    What's the threat model for a usb dongle? It won't have network access... I suppose it could spontaneously become an HID device and try typing its way to trouble, but that'd be very OS-specific...
    - nickthegreek 3y ago
      USB is like the most well known physical threat. Look up OMG Cables.
      - blacksmith_tb 3y ago
        Right, but that's intended for the attacker to connect to from nearby? Also of course presumably if it's got enough hardware crammed in there to cost $170 random Chinese tech companies are not going to include all of that in their $25 dongle "just in case" you turn out to be worth compromising?
        nickthegreek 3y ago
        I think you are overestimating the cost of inclusion. Surely you have had mandatory IT training about not plugging in unknown usb drives at work right?
        wintogreen74 3y ago
        Yes, but my work laptop is not a Zigbee hub that I randomly plug unknown USB devices into.
  - fabianhjr 3y ago
    I am more worried about US stuff with the whole PRISM thing and other three letter shenanigans. Aditionally the comment you are replying to is a dongle to provide a single board computer (or a computer in general) with ZigBee conectivity. Ideally you would run a trusthworthy open source OS and hub software.
    - jquast 3y ago
      Agreed, I would rather a foreign agency with no power or authority over me to have my personal data than a government that has the authority to wrongfully tax, investigate, jail, prosecute, and imprison me for that same data.
      - brandensilva 3y ago
        Now I'm imagining a self destructing roborock vacuum burning down my house when China goes deep in anti US territory. Best policy I abide by is to prevent any data from exiting my network or remote control period. I don't care who is spying.
        paledot 3y ago
        Most likely you won't have that problem because the power grid will be offline.
      - cgriswald 3y ago
        You should choose the devices that are the most secure, using the information you have available at the time. Choosing a foreign government to spy on you rather than your own government isn't a clear choice. While a foreign government is less likely to be interested in you personally and likely less able to directly cause you harm, you also have less recourse against them than against your own government and their interests are less likely to be aligned with yours. Additionally, your government may be able to co-opt the compromised devices anyway and would certainly have an incentive to do so. I'd also question that a device that is by-design-compromised is otherwise secure from bad actors. It is difficult to imagine the incentive structure that would make that possible. Finally, once this personal data has been harvested by either government, there is nothing to stop these governments or rogue elements within these governments from trading or sharing that data with your own government or other actors.
  - andylynch 3y ago
    These Zigbee sticks don’t have much opportunity for naughtiness. Like others I’ve used, they communicate over serial with their host (no IP ), and are based on a TI chipset which you can flash.
  - filterfiber 3y ago
    As other's mentioned, they communicate via serial to the host, this is not a device I'd be greatly concerned about as a threat. Unless you took great care with sourcing your electronics then they're already packed with chips/parts from china. If you _really_ want to you can use a nRF52840 (Nordic Semi is from Norway), or I think a few TI chips (USA), and use those as a gateway instead with home assistant (might need to add an extra library). Even then, both companies have manufacturing plants in china AFAIK so...
Mister_Snuggles 3y ago
All of my Xiaomi stuff is Zigbee and runs through Zigbee2MQTT, I'm not too concerned here since there's no Xiaomi stuff that's capable of connecting to anything except my Zigbee adapter.
giobox 3y ago
> They have repeatedly proven to be a major privacy concern. Maybe security concern as well. Thanks to Zigbee being a standard, you can use a Zigbee hub/adapter from any vendor you like. The Zigbee sensors themselves have no network connection and therefore noway to warrant privacy concerns really. There is no WiFi/Ethernet or internet involved with anything Xiaomi here. I'm using a bunch of these Aquara Zigbee sensors with the open source Home Assistant software and hardware, they are for the most part fantastic. I would take Zigbee home automation devices over crappy wifi ones any day of the week - its a vastly better protocol/methodology for hooking these sorts of devices up. Your home's lights functioning properly ideally should not depend on bulbs/switches being able to get an IP address etc (sigh)... > https://www.home-assistant.io/skyconnect https://www.home-assistant.io/skyconnect - USB adapter for Zigbee from HomeAssistant you can plug into any box you like. > https://www.home-assistant.io/yellow/ https://www.home-assistant.io/yellow/ - HomeAssistant server hardware with Zigbee radio built in.
- AdamTReineke 3y ago
  The Aqara temperature sensors[0] wouldn't stay connected to my SkyConnect USB dongle. No issues with my Zigbee switch and thermostats though, so I think some vendors aren't fully Zigbee compliant but it's probably the exception. [0] https://www.amazon.com/gp/product/B07D37FKGY/ https://www.amazon.com/gp/product/B07D37FKGY/
  - giobox 3y ago
    I've had great results with their buttons/light switches and Home Assistant Yellow, and the SkyConnect prior to that, for what its worth. I especially like the PoE version of Home Assistant Yellow - can power the entire server from its ethernet port.
  - bsder 3y ago
    What would you recommend for a ZigBee thermostat?
    - BHSPitMonkey 3y ago
gruturo 3y ago
That's the beauty of Zigbee. You can run your own hub if you want, and no information leaves your home. Of course this is less, or not at all, true if you run a manufacturer's hub.
aaron695 3y ago
[dead]
boringuser2 3y ago
It's zigbee. Run your own Conbee stick and the value is off the charts.
- Mister_Snuggles 3y ago
  I started with a Conbee plus deCONZ and it worked very well. I've since switched to a SLZB-06[0] plus Zigbee2MQTT and it's incredible. [0] https://smlight.tech/product/slzb-06/ https://smlight.tech/product/slzb-06/
  - boringuser2 3y ago
    I'm glad it's working well for gou. What are the advantages of that over a Conbee? My Zigbee network is completely flawless and the Conbee picks up pretty much any device. Pretty hard to improve on that I'd think.
    - Mister_Snuggles 3y ago
      There were two things that pushed me to the SLZB-06: * deCONZ was slow to get new device support and I had purchased some devices that weren't supported (Ikea STARKVIND) at the time. I think this has been improved since I last used it though. * The SLZB-06 can be powered by PoE which gives it a lot more flexibility than anything connected by USB. Also, since it's not USB-connected, it's a lot easier to deal with (no need to figure out USB passthrough, etc).
      - boringuser2 3y ago
        I see, I appreciate the knowledge of your experiences. I'm running HA in a host-privileged docker on my system so it's fairly ergonomic, I'm sure there's room for security improvement there, though.

andylynch 3y ago

That is a valid concern, but not such an issue with Zigbee stuff since you can run it with your own hub giving the sensors 0 external connectivity.

orphea 3y ago

Their sensors are fine, just use a non-Xiaomi hub like SONOFF Zigbee 3.0 USB Dongle.

NicoJuicy 3y ago
Sonoff is chinese, doesn't fix the security issue
- blacksmith_tb 3y ago
  What's the threat model for a usb dongle? It won't have network access... I suppose it could spontaneously become an HID device and try typing its way to trouble, but that'd be very OS-specific...
  - nickthegreek 3y ago
    USB is like the most well known physical threat. Look up OMG Cables.
    - blacksmith_tb 3y ago
      Right, but that's intended for the attacker to connect to from nearby? Also of course presumably if it's got enough hardware crammed in there to cost $170 random Chinese tech companies are not going to include all of that in their $25 dongle "just in case" you turn out to be worth compromising?
      - nickthegreek 3y ago
        I think you are overestimating the cost of inclusion. Surely you have had mandatory IT training about not plugging in unknown usb drives at work right?
        wintogreen74 3y ago
        Yes, but my work laptop is not a Zigbee hub that I randomly plug unknown USB devices into.
- fabianhjr 3y ago
  I am more worried about US stuff with the whole PRISM thing and other three letter shenanigans. Aditionally the comment you are replying to is a dongle to provide a single board computer (or a computer in general) with ZigBee conectivity. Ideally you would run a trusthworthy open source OS and hub software.
  - jquast 3y ago
    Agreed, I would rather a foreign agency with no power or authority over me to have my personal data than a government that has the authority to wrongfully tax, investigate, jail, prosecute, and imprison me for that same data.
    - brandensilva 3y ago
      Now I'm imagining a self destructing roborock vacuum burning down my house when China goes deep in anti US territory. Best policy I abide by is to prevent any data from exiting my network or remote control period. I don't care who is spying.
      - paledot 3y ago
        Most likely you won't have that problem because the power grid will be offline.
    - cgriswald 3y ago
      You should choose the devices that are the most secure, using the information you have available at the time. Choosing a foreign government to spy on you rather than your own government isn't a clear choice. While a foreign government is less likely to be interested in you personally and likely less able to directly cause you harm, you also have less recourse against them than against your own government and their interests are less likely to be aligned with yours. Additionally, your government may be able to co-opt the compromised devices anyway and would certainly have an incentive to do so. I'd also question that a device that is by-design-compromised is otherwise secure from bad actors. It is difficult to imagine the incentive structure that would make that possible. Finally, once this personal data has been harvested by either government, there is nothing to stop these governments or rogue elements within these governments from trading or sharing that data with your own government or other actors.
- andylynch 3y ago
  These Zigbee sticks don’t have much opportunity for naughtiness. Like others I’ve used, they communicate over serial with their host (no IP ), and are based on a TI chipset which you can flash.
- filterfiber 3y ago
  As other's mentioned, they communicate via serial to the host, this is not a device I'd be greatly concerned about as a threat. Unless you took great care with sourcing your electronics then they're already packed with chips/parts from china. If you _really_ want to you can use a nRF52840 (Nordic Semi is from Norway), or I think a few TI chips (USA), and use those as a gateway instead with home assistant (might need to add an extra library). Even then, both companies have manufacturing plants in china AFAIK so...

Mister_Snuggles 3y ago

All of my Xiaomi stuff is Zigbee and runs through Zigbee2MQTT, I'm not too concerned here since there's no Xiaomi stuff that's capable of connecting to anything except my Zigbee adapter.

giobox 3y ago

> They have repeatedly proven to be a major privacy concern. Maybe security concern as well. Thanks to Zigbee being a standard, you can use a Zigbee hub/adapter from any vendor you like. The Zigbee sensors themselves have no network connection and therefore noway to warrant privacy concerns really. There is no WiFi/Ethernet or internet involved with anything Xiaomi here. I'm using a bunch of these Aquara Zigbee sensors with the open source Home Assistant software and hardware, they are for the most part fantastic. I would take Zigbee home automation devices over crappy wifi ones any day of the week - its a vastly better protocol/methodology for hooking these sorts of devices up. Your home's lights functioning properly ideally should not depend on bulbs/switches being able to get an IP address etc (sigh)... > https://www.home-assistant.io/skyconnect https://www.home-assistant.io/skyconnect - USB adapter for Zigbee from HomeAssistant you can plug into any box you like. > https://www.home-assistant.io/yellow/ https://www.home-assistant.io/yellow/ - HomeAssistant server hardware with Zigbee radio built in.

AdamTReineke 3y ago
The Aqara temperature sensors[0] wouldn't stay connected to my SkyConnect USB dongle. No issues with my Zigbee switch and thermostats though, so I think some vendors aren't fully Zigbee compliant but it's probably the exception. [0] https://www.amazon.com/gp/product/B07D37FKGY/ https://www.amazon.com/gp/product/B07D37FKGY/
- giobox 3y ago
  I've had great results with their buttons/light switches and Home Assistant Yellow, and the SkyConnect prior to that, for what its worth. I especially like the PoE version of Home Assistant Yellow - can power the entire server from its ethernet port.
- bsder 3y ago
  What would you recommend for a ZigBee thermostat?
  - BHSPitMonkey 3y ago

gruturo 3y ago

That's the beauty of Zigbee. You can run your own hub if you want, and no information leaves your home. Of course this is less, or not at all, true if you run a manufacturer's hub.

aaron695 3y ago

[dead]

boringuser2 3y ago

It's zigbee. Run your own Conbee stick and the value is off the charts.

Mister_Snuggles 3y ago
I started with a Conbee plus deCONZ and it worked very well. I've since switched to a SLZB-06[0] plus Zigbee2MQTT and it's incredible. [0] https://smlight.tech/product/slzb-06/ https://smlight.tech/product/slzb-06/
- boringuser2 3y ago
  I'm glad it's working well for gou. What are the advantages of that over a Conbee? My Zigbee network is completely flawless and the Conbee picks up pretty much any device. Pretty hard to improve on that I'd think.
  - Mister_Snuggles 3y ago
    There were two things that pushed me to the SLZB-06: * deCONZ was slow to get new device support and I had purchased some devices that weren't supported (Ikea STARKVIND) at the time. I think this has been improved since I last used it though. * The SLZB-06 can be powered by PoE which gives it a lot more flexibility than anything connected by USB. Also, since it's not USB-connected, it's a lot easier to deal with (no need to figure out USB passthrough, etc).
    - boringuser2 3y ago
      I see, I appreciate the knowledge of your experiences. I'm running HA in a host-privileged docker on my system so it's fairly ergonomic, I'm sure there's room for security improvement there, though.