6 ms·
Their sensors are fine, just use a non-Xiaomi hub like SONOFF Zigbee 3.0 USB Dongle.
by orphea 3y ago
Their sensors are fine, just use a non-Xiaomi hub like SONOFF Zigbee 3.0 USB Dongle.
- NicoJuicy 3y agoSonoff is chinese, doesn't fix the security issue
- blacksmith_tb 3y agoWhat's the threat model for a usb dongle? It won't have network access... I suppose it could spontaneously become an HID device and try typing its way to trouble, but that'd be very OS-specific...
- nickthegreek 3y agoUSB is like the most well known physical threat. Look up OMG Cables.
- blacksmith_tb 3y agoRight, but that's intended for the attacker to connect to from nearby? Also of course presumably if it's got enough hardware crammed in there to cost $170 random Chinese tech companies are not going to include all of that in their $25 dongle "just in case" you turn out to be worth compromising?
- nickthegreek 3y agoI think you are overestimating the cost of inclusion. Surely you have had mandatory IT training about not plugging in unknown usb drives at work right?
- wintogreen74 3y agoYes, but my work laptop is not a Zigbee hub that I randomly plug unknown USB devices into.
- fabianhjr 3y agoI am more worried about US stuff with the whole PRISM thing and other three letter shenanigans. Aditionally the comment you are replying to is a dongle to provide a single board computer (or a computer in general) with ZigBee conectivity. Ideally you would run a trusthworthy open source OS and hub software.
- jquast 3y agoAgreed, I would rather a foreign agency with no power or authority over me to have my personal data than a government that has the authority to wrongfully tax, investigate, jail, prosecute, and imprison me for that same data.
- brandensilva 3y agoNow I'm imagining a self destructing roborock vacuum burning down my house when China goes deep in anti US territory. Best policy I abide by is to prevent any data from exiting my network or remote control period. I don't care who is spying.
- paledot 3y agoMost likely you won't have that problem because the power grid will be offline.
- cgriswald 3y agoYou should choose the devices that are the most secure, using the information you have available at the time. Choosing a foreign government to spy on you rather than your own government isn't a clear choice. While a foreign government is less likely to be interested in you personally and likely less able to directly cause you harm, you also have less recourse against them than against your own government and their interests are less likely to be aligned with yours. Additionally, your government may be able to co-opt the compromised devices anyway and would certainly have an incentive to do so. I'd also question that a device that is by-design-compromised is otherwise secure from bad actors. It is difficult to imagine the incentive structure that would make that possible. Finally, once this personal data has been harvested by either government, there is nothing to stop these governments or rogue elements within these governments from trading or sharing that data with your own government or other actors.
- andylynch 3y agoThese Zigbee sticks don’t have much opportunity for naughtiness. Like others I’ve used, they communicate over serial with their host (no IP ), and are based on a TI chipset which you can flash.
- filterfiber 3y agoAs other's mentioned, they communicate via serial to the host, this is not a device I'd be greatly concerned about as a threat. Unless you took great care with sourcing your electronics then they're already packed with chips/parts from china. If you _really_ want to you can use a nRF52840 (Nordic Semi is from Norway), or I think a few TI chips (USA), and use those as a gateway instead with home assistant (might need to add an extra library). Even then, both companies have manufacturing plants in china AFAIK so...