Hacker News Reader

Comment by bradstewart | Hacker News Reader

This doesn't seem like a mistake, so much as a decision to assume the LAN is secure. It's a trade off that favors features over security. Which does seem rather "un-Googly" though...

If it's unauthenticated, apps/devices/services can easily integrate with it.

If it is authenticated, how? Pre-shared API key? How do you initially generate and distribute that API key? How do you access it? Now you need to encrypt that key when you use it. TLS? Great, now you need a TLS certificate that has to be trusted, updated, etc.

All solvable problems for sure, but at the cost of complexity, ease of integration, etc.

View on HN

At the end of the day this is a cast device which will advertise it's presence to the whole network white active and allow anyone to send media to it (and mirror screen to Chromecasts, which have the same API exposed as the author says).

Of course, the fact that you can't lock down Chromecast on a local network is a feature that could be very useful.

How is this difficult?

"This is the first time you are using this phone to modify the settings of your google appliance. Please locate your google device, and press <some button>, or tap the microphone firmly, to confirm your intent to trust this phone."

I would hate that.

It's not super difficult, particularly when the other end is a Google-provided app on a smartphone. It gets more complicated with things like Home Assistant[0] or other automation software.

Amazon made the decision to force all Echo integrations to go through the internet.

[0] https://www.home-assistant.io/

Some services use ultrasonic pairing, like (IIRC) Google Play Movies on Roku.

> It's a trade off that favors features over security.

I'd say it's moreso a trade off that favors "getting it out the door quickly" over security. It's reasonable that, if you want your app to integrate with a Google Home, you should expect it to be authenticated. Plus, the fact that this API is undocumented seems indicative that 3rd-party integration wasn't the purpose.

my understanding from a very good source is that the team that created Home is indeed not googley, not security focused, and in general not the best of the best. an enormous amount of money was spent to develop it and (being in an ultra competitive field) is a big money loser. the original reason for it was to be an iot hub, which still has not really been realized.

Reply on news.ycombinator.com