But if someone gets a bulb from your bins that you’ve thrown away because it was defective in some way, and gets access to your WiFi that way, it’s a bit annoying.
The first scenario seems unrealistic, since people who are important enough to hack tend to also pay attention to the security of their devices and how they dispose of their trash [0]. The second seems unrealistic because the chances of it happening seem slim to none.
[0]: https://theoutline.com/post/3994/it-is-weirdly-hard-to-steal...
Either you trust the lightbulb provider to protect your creds better or don't use it. In my opinion the lifx is reasonably protected and far from being the worst offender here: the attack doesnt work over the air, and depends on physical access to a pre-setup bulb and involves physical labour to access the credentials (needs cutting out the board, removing protecting glue from the board, dumping firmware). This is not really mass-exploitable. Services like wigle will allow to see where the wifi is located though, but the bar for attacking is pretty high.
Have a look here for really awfull IoT sec:
Lightbulbs? Not really. Especially for people who don't work in this field.
- sale of used smart TV
- thrown out wifi range extenders
- used wifi enabled cameras
- your smart fridge, toaster, whatever
You will not get Google Home Mini / Alexa levels of security with these.