4 ms·

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, u

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

Ecsta 3mo ago
There's a lot of public keys that don't give you any special access, unless the dev is really bad. Anyone who cares about security will be using App Attest or the Google store equivalent.
- JTbane 3mo ago
  >Anyone who cares about security I have something hilarious to tell you about IoT apps
  - tclancy 3mo ago
    A Venn diagram like a 6th grade boy's graffiti of boobs.
    - dhosek 3mo ago
      Just as a pedantic aside, people often use Venn diagram when they mean Euler diagram. A Venn diagram always has the overlapping circles and use shading or labeling describe the set relation. Euler diagrams let the circles describe the relation so two non intersecting sets in a Venn diagram might share the left circle green, the right blue and leave the intersection blank or grey. An Euler diagram will have two disjoint circles.
      - tclancy 3mo ago
        A. I love a pedantic aside B. I love that Euler is pronounced “oiler” which is North American slang for a drunk. I’ve been trying to find that constant my whole adult life.
        dhosek 3mo ago
        I learned the correct pronunciation when someone laughed at me at a TeX conference in the 80s when I made a reference to the You-ler fonts. In my single semester of high school German I was either never taught or ignored the teacher when the pronunciation of eu was given (or perhaps I just never connected it with Euler).
  - sophacles 3mo ago
    The "S" in IoT stands for security!
    - yako21000 3mo ago
      That one made me giggle!
  - cute_boi 3mo ago
    Most of these companies try to penny pinch and give task to hardware engineer. As a result there are lot of security issues with IOT devices.
- CodesInChaos 3mo ago
  > Anyone who cares about security will be using App Attest or the Google store equivalent. Why? I rarely have security objectives where remote attention would help, and it has a huge impact on user freedom. For B2C attestation is just an evil captcha.
inigyou 3mo ago
Everything can be controlled without a proprietary app. Hope you reverse engineer the protocol and publish how to do it.
- tehlike 3mo ago
  Or claude/codex can.
dev_l1x_be 3mo ago
In many cases it is bad to publish this info because they might come after you. There used to be a company who shielded the “researcher” from the legal consequences, can’t remember the name though.
- fragmede 3mo ago
  @stake or L0pht?
fragmede 3mo ago
Have you actually tried to do anything with them though? The keys are in there, but may not grant you any real extra access beyond what your user is actually allowed to do via the app.
- avgDev 3mo ago
  It is still pretty nice, you don't have to install yet another app to do something. People did this with Mazda app as it allowed them to start the car without subscription. They 'fixed' it.
inisirex 3mo ago
[flagged]
tehlike 3mo ago
Another rule of thumb - i know it's not always the best since some products are really nice aesthetically - is to buy only local smart stuff, for example, zigbee/zwave.
- petepete 3mo ago
  I live by this rule*. Being able to pick up stuff from IKEA that's well supported, well designed and really affordable is a huge advantage. *almost, I have two things that need an app. My Vaillant boiler and my Yale alarm system. Both apps are terrible, but I have a 10 year warranty on the boiler and my alarm is up to scratch from a home insurance point of view.**
  - tehlike 3mo ago
    Yale alarm? Can you link? Vailant boiler - I wonder if there's a debug interface you can use. Not knowing specifics of your model, i foudn this: https://github.com/jayme-github/esphome_vaillant https://github.com/jayme-github/esphome_vaillant Codex can help probably further heh.
    - petepete 3mo ago
      It's a Yale Sync https://yalehome.co.uk/yale-sync-hub https://yalehome.co.uk/yale-sync-hub It's not really something I want 'home rolled', I just want it to work. Same goes for the boiler really. If it stops working I can phone Valliant and they'll send someone round to fix it.
zrobotics 3mo ago
Ugh, that's a new low. I can't think of a single good reason a lighting app would need shopify api access. That said, I've done some consulting work on shopify stores, and I wouldn't be shocked at all to see something like that at all. The bar for code quality that a lot of low end consultants/designers deliver is just abysmal.
vhiremath4 3mo ago
What lights did you get? I have Oasis. Love them but same thing would rather control them through a central bot or something.

Ecsta 3mo ago

There's a lot of public keys that don't give you any special access, unless the dev is really bad. Anyone who cares about security will be using App Attest or the Google store equivalent.

JTbane 3mo ago
>Anyone who cares about security I have something hilarious to tell you about IoT apps
- tclancy 3mo ago
  A Venn diagram like a 6th grade boy's graffiti of boobs.
  - dhosek 3mo ago
    Just as a pedantic aside, people often use Venn diagram when they mean Euler diagram. A Venn diagram always has the overlapping circles and use shading or labeling describe the set relation. Euler diagrams let the circles describe the relation so two non intersecting sets in a Venn diagram might share the left circle green, the right blue and leave the intersection blank or grey. An Euler diagram will have two disjoint circles.
    - tclancy 3mo ago
      A. I love a pedantic aside B. I love that Euler is pronounced “oiler” which is North American slang for a drunk. I’ve been trying to find that constant my whole adult life.
      - dhosek 3mo ago
        I learned the correct pronunciation when someone laughed at me at a TeX conference in the 80s when I made a reference to the You-ler fonts. In my single semester of high school German I was either never taught or ignored the teacher when the pronunciation of eu was given (or perhaps I just never connected it with Euler).
- sophacles 3mo ago
  The "S" in IoT stands for security!
  - yako21000 3mo ago
    That one made me giggle!
- cute_boi 3mo ago
  Most of these companies try to penny pinch and give task to hardware engineer. As a result there are lot of security issues with IOT devices.
CodesInChaos 3mo ago
> Anyone who cares about security will be using App Attest or the Google store equivalent. Why? I rarely have security objectives where remote attention would help, and it has a huge impact on user freedom. For B2C attestation is just an evil captcha.

inigyou 3mo ago

Everything can be controlled without a proprietary app. Hope you reverse engineer the protocol and publish how to do it.

tehlike 3mo ago
Or claude/codex can.

dev_l1x_be 3mo ago

In many cases it is bad to publish this info because they might come after you. There used to be a company who shielded the “researcher” from the legal consequences, can’t remember the name though.

fragmede 3mo ago
@stake or L0pht?

fragmede 3mo ago

Have you actually tried to do anything with them though? The keys are in there, but may not grant you any real extra access beyond what your user is actually allowed to do via the app.

avgDev 3mo ago
It is still pretty nice, you don't have to install yet another app to do something. People did this with Mazda app as it allowed them to start the car without subscription. They 'fixed' it.

inisirex 3mo ago

[flagged]

tehlike 3mo ago

Another rule of thumb - i know it's not always the best since some products are really nice aesthetically - is to buy only local smart stuff, for example, zigbee/zwave.

petepete 3mo ago
I live by this rule*. Being able to pick up stuff from IKEA that's well supported, well designed and really affordable is a huge advantage. *almost, I have two things that need an app. My Vaillant boiler and my Yale alarm system. Both apps are terrible, but I have a 10 year warranty on the boiler and my alarm is up to scratch from a home insurance point of view.**
- tehlike 3mo ago
  Yale alarm? Can you link? Vailant boiler - I wonder if there's a debug interface you can use. Not knowing specifics of your model, i foudn this: https://github.com/jayme-github/esphome_vaillant https://github.com/jayme-github/esphome_vaillant Codex can help probably further heh.
  - petepete 3mo ago
    It's a Yale Sync https://yalehome.co.uk/yale-sync-hub https://yalehome.co.uk/yale-sync-hub It's not really something I want 'home rolled', I just want it to work. Same goes for the boiler really. If it stops working I can phone Valliant and they'll send someone round to fix it.

zrobotics 3mo ago

Ugh, that's a new low. I can't think of a single good reason a lighting app would need shopify api access. That said, I've done some consulting work on shopify stores, and I wouldn't be shocked at all to see something like that at all. The bar for code quality that a lot of low end consultants/designers deliver is just abysmal.

vhiremath4 3mo ago

What lights did you get? I have Oasis. Love them but same thing would rather control them through a central bot or something.