Hacker News Reader

The 4 digit authentication code prevents you from sending your WiFi password to an evil device.

Yeah, I'm not sure what flow lets you bypass that that GP is refering to. My impression was there aren't any, you always need to be able to see the screen to get the PIN code, and presumably there's rate limiting on trying codes.

I'm referring to that four letter code. Google Home app does not even request user to input that.

This screen only protect you from entering wi-fi details to third party that's potentially malicious.

However, since the implementation does not ask users to input that code into Google Home app, it won't protect someone other than you (as long as they are in wi-fi coverage of the device) to configure or hijack your device. (and Google Chrome/Home drops down to this "waiting for configuration" state every time internet connection becomes unavailable.)

Latter is the issue I have raised.

Ah, I misremembered I guess. I could have sworn I had to type it in to authenticate the chromecast device to my phone for initial bootstrapping.

Reply on news.ycombinator.com