4 ms·

I will high-jack this top-rated comment to link to a comment further below. https://news.ycombinator.com/item?id=43469297 https://news.ycombinator.com/item?id=

I will high-jack this top-rated comment to link to a comment further below. https://news.ycombinator.com/item?id=43469297 https://news.ycombinator.com/item?id=43469297 This comment has a link to [0], explaining, in plain text: However, perhaps inline with the German attitudes towards privacy, the BSH "HomeConnect" appliances have a no-cloud mode built into their app without any hacks required to disconnect them from the internet. They do require a one-time connection to perform key exchange of a long-live authorization key, but from then on the appliances can be operated entirely disconnected from the network. [0] https://trmm.net/homeconnect/ https://trmm.net/homeconnect/

deleted 2y ago
[deleted]
kevincox 2y ago
> They do require a one-time connection to perform key exchange of a long-live authorization key What does my offline dishwasher need a long-lived authorization key for?
- lmz 2y ago
  Maybe it has some embargoed technology and needs to make sure it's not in China or something.
  - kevincox 2y ago
    IANAL but I'm pretty sure the issue is distribution, so as long as they don't sell their dishwasher in China it isn't their problem. If someone buys and resells it in China then the reseller is in trouble. (Obviously it is a bit more complicated if they should know about this reselling but it shouldn't require online activation.)
    - lmz 2y ago
      It's a joke. It's probably made there anyway.
- a_paddy 2y ago
  I assume only if you're setting it up to work "offline" with the app. Issuing a key pair to the hardware and the app from their ecosystem's trusted authority does seem like a secure way to do it.
  - spicybright 2y ago
    Why can't the dishwasher or phone generate that key though?
    - deafpolygon 2y ago
      Because they want people to connect online.
    - skinner927 2y ago
      I’ll assume they use this to “register” your product so they know when the warranty actually started.
thih9 2y ago
Cool. I’d still prefer a “no wifi” or even “no app” mode, and control everything via hardware buttons. Hardware offline UX gives me hope that my data would not be sold or that I wouldn’t have to pay for an extra subscription or watch ads. Perhaps it’s correlation. Still, “no cloud” is a step in the right direction; I’ll take it.
pashadee 2y ago
“ In no-cloud mode the only way to interact with the devices is through their app, and an app isn’t always the most convenient way to interact with devices in the home.”
- bonzini 2y ago
  Note that it is "the only way to interact remotely". That is, no cloud mode disables interaction with e.g. Home Assistant but not interaction with the buttons.
js2 2y ago
Jeff mentions it in the post: > Another third option is somebody has reverse engineered this protocol and built HCPY, a Home Connect Python library. > But here's the problem: I already spent like four hours getting this dishwasher installed in my kitchen. I don't want to spend another four hours configuring my own web UI for it—which still requires at least a one-time connection through Home Connect!—and maintaining that as a service on my local network, relying on an unauthorized third party library using reverse-engineering to get at the private dishwasher API!
DavideNL 2y ago
...how long is "long-live" ? We've all been there. It works, until the shareholders decide differently, and you can no longer use your dishwasher without connecting / agreeing to the terms.
- fransje26 2y ago
  The shareholder of Bosch is, with 94% of the shares, the Robert Bosch Foundation. Look it up to see what they do. https://en.wikipedia.org/wiki/Robert_Bosch_Stiftung https://en.wikipedia.org/wiki/Robert_Bosch_Stiftung
JohnFen 2y ago
That's an improvement, but the requirement to use an app is still a serious problem, even if it never phones home. Everything should be able to be done on the appliance itself. Installing an app should never be a requirement.
- pkulak 2y ago
  I disagree. Moving stuff to an API with full local control is a UI decision. Moving it to the cloud is a privacy and obsolescence decision. Huge difference.
  - JohnFen 2y ago
    Using an app has inherent security implications (it's very, very hard to trust apps). However, I agree that in terms of security, using an app with local control is better than something cloud-connected. My primary issue with requiring the use of an app is that apps are a pain in the ass. Allow the use of an app as an option, sure, but the appliances should be able to be fully used with the controls on the appliance itself as well. Requiring the use of an app is a dealbreaker for me, but for usability reasons more than security reasons.
    - paulddraper 2y ago
      Hence the UX decision

deleted 2y ago

[deleted]

kevincox 2y ago

> They do require a one-time connection to perform key exchange of a long-live authorization key What does my offline dishwasher need a long-lived authorization key for?

lmz 2y ago
Maybe it has some embargoed technology and needs to make sure it's not in China or something.
- kevincox 2y ago
  IANAL but I'm pretty sure the issue is distribution, so as long as they don't sell their dishwasher in China it isn't their problem. If someone buys and resells it in China then the reseller is in trouble. (Obviously it is a bit more complicated if they should know about this reselling but it shouldn't require online activation.)
  - lmz 2y ago
    It's a joke. It's probably made there anyway.
a_paddy 2y ago
I assume only if you're setting it up to work "offline" with the app. Issuing a key pair to the hardware and the app from their ecosystem's trusted authority does seem like a secure way to do it.
- spicybright 2y ago
  Why can't the dishwasher or phone generate that key though?
  - deafpolygon 2y ago
    Because they want people to connect online.
  - skinner927 2y ago
    I’ll assume they use this to “register” your product so they know when the warranty actually started.

thih9 2y ago

Cool. I’d still prefer a “no wifi” or even “no app” mode, and control everything via hardware buttons. Hardware offline UX gives me hope that my data would not be sold or that I wouldn’t have to pay for an extra subscription or watch ads. Perhaps it’s correlation. Still, “no cloud” is a step in the right direction; I’ll take it.

pashadee 2y ago

“ In no-cloud mode the only way to interact with the devices is through their app, and an app isn’t always the most convenient way to interact with devices in the home.”

bonzini 2y ago
Note that it is "the only way to interact remotely". That is, no cloud mode disables interaction with e.g. Home Assistant but not interaction with the buttons.

js2 2y ago

Jeff mentions it in the post: > Another third option is somebody has reverse engineered this protocol and built HCPY, a Home Connect Python library. > But here's the problem: I already spent like four hours getting this dishwasher installed in my kitchen. I don't want to spend another four hours configuring my own web UI for it—which still requires at least a one-time connection through Home Connect!—and maintaining that as a service on my local network, relying on an unauthorized third party library using reverse-engineering to get at the private dishwasher API!

DavideNL 2y ago

...how long is "long-live" ? We've all been there. It works, until the shareholders decide differently, and you can no longer use your dishwasher without connecting / agreeing to the terms.

fransje26 2y ago
The shareholder of Bosch is, with 94% of the shares, the Robert Bosch Foundation. Look it up to see what they do. https://en.wikipedia.org/wiki/Robert_Bosch_Stiftung https://en.wikipedia.org/wiki/Robert_Bosch_Stiftung

JohnFen 2y ago

That's an improvement, but the requirement to use an app is still a serious problem, even if it never phones home. Everything should be able to be done on the appliance itself. Installing an app should never be a requirement.

pkulak 2y ago
I disagree. Moving stuff to an API with full local control is a UI decision. Moving it to the cloud is a privacy and obsolescence decision. Huge difference.
- JohnFen 2y ago
  Using an app has inherent security implications (it's very, very hard to trust apps). However, I agree that in terms of security, using an app with local control is better than something cloud-connected. My primary issue with requiring the use of an app is that apps are a pain in the ass. Allow the use of an app as an option, sure, but the appliances should be able to be fully used with the controls on the appliance itself as well. Requiring the use of an app is a dealbreaker for me, but for usability reasons more than security reasons.
  - paulddraper 2y ago
    Hence the UX decision