Comment by whalesalad
4 days ago
I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.
There's a lot of public keys that don't give you any special access, unless the dev is really bad.
Anyone who cares about security will be using App Attest or the Google store equivalent.
>Anyone who cares about security
I have something hilarious to tell you about IoT apps
A Venn diagram like a 6th grade boy's graffiti of boobs.
3 replies →
The "S" in IoT stands for security!
1 reply →
Most of these companies try to penny pinch and give task to hardware engineer. As a result there are lot of security issues with IOT devices.
> Anyone who cares about security will be using App Attest or the Google store equivalent.
Why? I rarely have security objectives where remote attention would help, and it has a huge impact on user freedom. For B2C attestation is just an evil captcha.
Have you actually tried to do anything with them though? The keys are in there, but may not grant you any real extra access beyond what your user is actually allowed to do via the app.
It is still pretty nice, you don't have to install yet another app to do something. People did this with Mazda app as it allowed them to start the car without subscription. They 'fixed' it.
Another rule of thumb - i know it's not always the best since some products are really nice aesthetically - is to buy only local smart stuff, for example, zigbee/zwave.
I live by this rule*. Being able to pick up stuff from IKEA that's well supported, well designed and really affordable is a huge advantage.
*almost, I have two things that need an app. My Vaillant boiler and my Yale alarm system. Both apps are terrible, but I have a 10 year warranty on the boiler and my alarm is up to scratch from a home insurance point of view.**
Yale alarm? Can you link?
Vailant boiler - I wonder if there's a debug interface you can use. Not knowing specifics of your model, i foudn this: https://github.com/jayme-github/esphome_vaillant
Codex can help probably further heh.
1 reply →
Ugh, that's a new low. I can't think of a single good reason a lighting app would need shopify api access.
That said, I've done some consulting work on shopify stores, and I wouldn't be shocked at all to see something like that at all. The bar for code quality that a lot of low end consultants/designers deliver is just abysmal.
In many cases it is bad to publish this info because they might come after you. There used to be a company who shielded the “researcher” from the legal consequences, can’t remember the name though.
@stake or L0pht?
What lights did you get? I have Oasis. Love them but same thing would rather control them through a central bot or something.
Everything can be controlled without a proprietary app. Hope you reverse engineer the protocol and publish how to do it.
Or claude/codex can.
[flagged]