Hacking the Philips Sonicare NFC Password
twitter.com
twitter.com
Its only smart-ish feature is the vibrating quadrant timer, it feels like it cleans more or less the same as my old Sonicare, it uses a normal AAA, and best of all it was like $30.
There's no real third-party ecosystem for heads yet, but I'll happily trade that for something that just works.
To me, it looks like they are charging more for increased inconvenience. What a crazy world
Maybe soniccare will be the high end model and Phillips will be the one with “special offers” aka making you listen to a jingle about mouthwash while brushing your teeth.
Electric toothbrush marketing designations are out of control. When I was looking for one I found a website that went out of its way to identify which models were behind marketing wording and numbers and what their specs were (mainly: movements per minute and pulsations per minute). Companies love to rebrand the same models with different numbers based on how many additional brushes they put in the package but they rarely put those specs on their own websites. Anyway, oral b 2700 still looks good.
> is starting to shit the bed
Off-topic but... language, please ?
According to an ex-Sonicare senior engineer I work with, this is not actually what's important at all. The key thing they looked at (and still do look at) is the amplitude/travel distance of the bristle tips, and how that changes under load. It should stay strong under light load, but collapse under heavy load (so that when you mash the thing way too hard into your gums, power transfer stops and your gums don't get brutalized). It's a surprisingly delicate balance.
We recently had cause to look at a few of these devices (sorry for the vagueness, you know how it goes) and most of the non-Sonicare ones are pretty awful. The rotary Oral-B ones aren't bad at what they are, but they aren't the same. There is one Sonicare clone that really impressed though, and it's not expensive.
Isn't that what the pressure sensor is supposed to be for ?
Come on. Don't do that without naming it.
I thought the same until I tried a Sonicare. The cheap Oral B models feel more like power drills in comparison (and also started destroying my gums).
I picked up a compatible battery but haven’t taken the time to pull it apart yet. It does require soldering.
The company scrambled the model numbers and it’s not easy to figure out which are similar or even the same.
The obfuscation of product differences, release dates and nerfs to longevity are all over consumer goods.
I hope open product designs + micro hyper local manufacturing capability will deeply erode the power of companies creating these wasteful, capital-driven artifacts.
So what did you decide on?
This functionality is implemented using NFC, and as per protocol recommendations, there is a password. Given the low cost requirements and extremely low risks, this password is static, and can be sniffed as described in this blog post.
If you are at all offended by this, you can feel free to either ignore the Sonicare handle's beeps/lights upon tip expiry, use non-NFC third-party tips, use a non-Sonicare brush handle, use a regular toothbrush, or not brush your teeth at all (not medical advice). Big Toothbrush may be out to get you, but they're not quite there yet.
If you think this is actually kind-of cool, good for you! Analyzing NFC and other 'household' protocols is a really nice hobby, and you can get started using low-cost tools.
P.S. Just got a HN 'if this is really your comment, please press Submit again' prompt that I hadn't seen before. Doing as instructed worked, but escaped the formatting chars in my comment, i.e. every asterisk got replaced by a backslash-asterisk. Thrilling, I know...
I ask because I have an old base with an UV brush compartment but I’m quite sure the base has no NFC.
I just tested it. The frequency seems to stay the same. Tongue clean mode seems to move the brush left to right. Normal clean mode seems to move it up and down as well. Hard to tell it vibrates so fast on small distances.
Everyone in the Twitter thread seems really mad about the whole thing, but it's a fine use of NFC if you ask me. Remember, the brush is authenticating the handle with the password, not the other way around. This scheme is not useful for DRM, but is useful if you use more than one type of brush and if you want to be alerted when it's time to change your brush. I just change them on the 1st of the month, but if you want even more life than that, the feature is available. You aren't screwing over Sonicare by using a worn-out brush, you're just spending 2 minutes not cleaning your teeth.
Hopefully much easier to read.
1- remove that NFC nonsense.
2- leave everything as it is and pretend nothing happened (very likely if the news about the hack don't spread too much).
3- waste time and resources to implement proper encryption plus protection, then enforce it in new Sonicare products, possibly giving also them in exchange of old ones for being "new and upgraded for customer's convenience".
Not holding my breath waiting for 1 to happen.
That "NFC nonsense" is an optional brushhead replacement reminder feature. It never stops you from continuing to use a brushhead, and if you hate the reminder, you can turn the feature off completely.
You can also buy brushheads that dont have NFC chips in them - its not required.