Hacker News Reader

Comment by kennu | Hacker News Reader

I love WiFi on my home appliances. Washing machine sends notifications when it's finished or when it's running out of detergent, air purifier notifies when it's time to change the filter, A/C lets me turn it on remotely when I feel too hot, etc. I don't really get people who opt out of these convenience features.

View on HN

Vendors have no incentive to provide any security updates after original purchase. Even assuming the original code was solid and had no known security flaws (this isn't the case, hardware vendors wrote godawful code full of holes), anything in the future makes it an easily exploitable vector into my home network.

These apps often require ridiculous invasions of privacy - refusing to work if you don't give them full access to location, running in the background, etc. - and work poorly at best.

In 30+ years of using computers, I thought that printer companies were my go-to standard for truly hideous software, but appliances are pushing the bar even lower. If my company interviewed a candidate from one of them who didn't proactively state that they formally protested the shipping of their software, I would in most cases refuse to hire them.

In my view the level of home network security should be based on actual risk level, eg focusing on automated attacks rather than targeted attacks, and based on an evaluation of what data you may actually lose and could you back it up offline. Aiming for some kind of perceived 100% security will just make you give up a lot of convenience to mitigate risks that probably never realize or that don't actually matter that much.

Automated attacks like scanning for devices with known bugs that love to poke holes in your firewall to talk to their servers?

The UK PSTI legislation currently going through Parliament includes penalties of up to 4% of worldwide revenue if manufacturers don't live up to their product security obligations. That should be a reasonable incentive.

https://www.gov.uk/guidance/the-product-security-and-telecom...

> These apps often require ridiculous invasions of privacy - refusing to work if you don't give them full access to location, running in the background[...]

The "full access to location" to that is likely because of Android's broken security model, which made asking for location the only way various apps had to bind to some physical device. It's apparently being fixed[1].

As for running in the background: Isn't that because it needs to poll for and receive the notification?

1. https://www.androidpolice.com/2021/05/19/android-12-apps-won...

You can do notifications without polling in the background.

Even Facebook Messenger doesn't require the "run in the background" permission, and yet all sorts of cheapest Chinese bidder IoT and Appliance garbage apps check for it and refuse to run if you don't grant it - such as the app for Thinkware dashcams.

I bought a Samsung TV, was pretty satisfied with it. One day it updated itself and now it has forced some kind of Samsung TV service onto itself that is very visibly promoted whenever I go to switch to a different hooked-up appliance. It annoys me to no end.

I jailbroke my LG TV. So I have shell access but also have a decent smart TV, and I removed all the ads. Also have ad free Youtube. I like it a lot more now.

You should write this up, sounds pretty interesting.

Hah I literally googled it and used this exploit in the browser. Someone else did the hard work for me. For the ads there’s some python scripts that aren’t working but it’s not super difficult to figure out.

https://github.com/RootMyTV/RootMyTV.github.io

Is LG the only mainstream TV manufacturer which allows this?

Did you follow a guide for this or did it on your own? A write-up would be amazing, I'd love to have ad-free Youtube on my C1

I just used https://github.com/RootMyTV/RootMyTV.github.io not sure it’ll work on the OLED TVs, I got a $200 50’ on clearance and didn’t want all the crud. I’m thinking of adding some cron jobs to it that disable it during certain hours so my kids can’t watch tv all the time and fun stuff like that.

A guide would be interesting.

Dumb question w.r.t washing machine: don't you have to dose detergent in with each load, or do newer machines have some sort of large reservoir? If the former, how would it know if you're running low on detergent?

This model has a large reservoir where you can pour the entire bottle and it'll autodose based on some settings. It's a nice convenience that you can just put the clothes in and hit start to wash with defaults.

I have a washing machine with WiFi (brand Candy). Connected their Android app, everything worked fine. Tried to connect their iOS app, while connected to Android app (so two users can use it). Connecting two devices has broken WiFi so much that it is not working anymore for neither app and only available interface is very limited knob. At least.

Appliance manufacturers are worse than car OEMs in this sense. Making stuff which nobody asked for while screwing it up.

I disagree with "stuff which nobody asked for" because I have asked for smart features in appliances and generally choose products that have them. However, I do agree that many times especially the smaller and cheaper manufacturers screw things up. Bigger brands seem to often have more reliable products and apps that generally work as intended. I've been pretty happy with apps from e.g. IKEA, Xiaomi, Bosch, Philips. They could all be better but they are serving their purpose.

Reply on news.ycombinator.com