Smart garage door controller is no longer smart | Hacker News Reader

Smart garage door controller is no longer smart

theverge.com

89 pointsballoob49 comments

These companies know that they can do this with impunity. Even if there is a lawsuit it will be a slap on the wrist that comes many many years later. Remember the PS3 thing.

What needs to happen is new consumer protection laws need to be put in place. Like when these changes occur to stop allowing functionality the manufacturer can either open source everything needed so the purchaser has the ability to self manage and retain the prior functions or the must offer a full refund in the amount of the MSRP regardless of age or proof of purchase, just return the product. Without a downside this will continue to happen.

Open sourcing would probably be their best option. Because it's been repeatedly shown that if they offer a good product people will still pay as the hassle for running/managing things like this isn't what most people care to do. The sad fact is they produce a subpar system and they only way they can get customers is to trap them.

Legislated “local access first” for devices that don’t logically need Internet access would be the most appropriate mandate, but you’ll need some sort of savant word wrangler to codify into law.

At least here on New Zealand this would likely qualify for a full rufund on the purchase price under our "Consumer Guarantees Act".

Same in Australia under Consumer Law.

In case anyone is interested, the Meross HomeKit garage door controller works great. I’ve had two running for a couple years with essentially no hitches. They don’t require internet access or an app other than HomeKit, which meets my needs perfectly.

Same, good experience, with the Meross Homekit capable garage opener. I do like that it’s a wired setup, which us more secure (I just erased all the paired radio openers). My only gripe is that I have Apple Watch Series 3 and the resent forced upgrade of the Home app means I can bo longer control anything from my watch which sucks!

Doesn't the garage door use some proprietary protocol that the opener doesn't support?

The Meross works with basically everything. It basically mimics a physical button closing the loop.

We use the Meross opener since the previous owner installed some cheap, incompatible opener.

I honestly don't know how anyone can feel confident buying any "smart home" gadget that requires an internet connection to work, especially when HomeKit and HomeAssistant exists!

If HomeKit/HomeAssistant didn't exist I would simply have a dumb home, it's not worth the risk.

Just bought one and the accessory for my opener yesterday, looking forward to getting it installed next week.

For whatever it is worth, my skepticism of devices that require a separate app or remote API integration has steadily then dramatically increased over the last few years. I cannot rely on 1) small, perhaps-VC-funded operations continuing to exist more than a few years and 2) even for large players in the IOT space (Apple, Google), I worry about long term support. At what point will I be faced with the prospect of buying a new car to ensure that I can continue using CarPlay? (At that point I'll just buy a phone mount.)

To that end, I recently picked up a Flirc remote to control my byzantine gaming and home theater setup [1]. It doesn't support all the features I need (yet), I'm concerned that the company will not be able to delivery on their roadmap, BUT they release their remote configuration tool as a stand-alone app that I know I can keep running, perhaps in a VM if needed, for the lifetime of the remote. All of the other smart remote alternatives require smartphone apps to program and maintain, and I have zero faith that they won't disappear and turn the remote into ewaste long before the remote hardware fails (or I stop having a need for it).

1: https://flirc.tv/products/skip1s-remote-universal-remote-con...

Stallman Was Right

There is a device on Amazon that hooks up to Smart App (or Alexa) that you can get for about $20. It is just 2.4ghz wifi and a couple wires and hooks up in a few minutes. Comes under a bunch of various chinese knockoff sellers... this thing works great.

https://www.amazon.com/AGSHOME-Control-Compatible-Assistant-...

Are there any openers that are just Z-Wave and that's it? No WiFi no company owned cloud.

Or should people just get a dry-contact Z-Wave relay and do it themselves?

I think the problem with using a relay is that you probably miss state information like open/closed/obstructed, etc.

You're on the right track here. Garage doors are a security risk and safety hazard. All these homebrewed, cobbled together solutions aren't tested to UL standards like the official stuff is.

You can leave the infrared sensors in place, and use the relay to simulate a button press. It wouldn't be any more dangerous than clicking your remote when you can't see the door.

You'd close a garage door blindly and ignore any problems that could occur? You haven't thought this through.

I'm pretty sure that's how most remote controlled garage doors get closed.

Maybe some people in individual houses watch and wait for their door to be fully closed before driving away, but that doesn't seem to be the norm for collective housing (I've certainly never cared myself) or even for most individual garages around here.

MyQ lets you close them blindly. In fact, it has a built in timer that will blindly close it for you, after 30 minutes, or whatever you choose.

They have pressure sensor strips along the bottom to detect impact that's not the ground, to make this reasonable.

It's not some new idea, it's the current state of all of these remote doors.

Yes? The garage door opener has limit switches and PIR sensors attached to it to handle the safety stuff, the remote is simply a switch..

The problem with this is Chamberlain also implemented an encrypted protocol over their control wires in the name of "security".

If there's a button somewhere, there's gotta be a place I can splice into and pretend to be a finger, right?

Yep, but you need to do it on the board of a proprietary doorbell. Many projects take a cheap one and modify it. The unique thing about ratgdo is it reverse engineered the protocol.

>> I think the problem with using a relay is that you probably miss state information like open/closed/obstructed, etc.

> You're on the right track here. Garage doors are a security risk and safety hazard. All these homebrewed, cobbled together solutions aren't tested to UL standards like the official stuff is.

How so? I don't think anyone's talking about a homebrewed garage door opener, just a hacked garage door opener remote. It would almost certainly be physically and electrically isolated from the actual UL-tested opener.

If you're doing homebrew, a pretty easy and effective solution to the "state" problem is point a camera at the door. That also gives you better (remote) situational awareness when the door is going to close than any commercial solution on the market (though I haven't actually checked what's available in 10 years).

I actually built a IOT garage door remote about 10 years ago (I got the hardware working, but lost steam with the control software beyond running commands over ssh). The effort I spent to directly sense the door state was a waste. You've got a good solution with a Raspberry Pi, an off-the-shelf remote, a reed relay wired to one of the buttons, and a webcam.

But ultimately, the best and cheapest solution is neighbors who will help you.

I built garage door sensor using a Fibaro Z-Wave Smart Implant and $10 magnetic sensor off ebay. There's enough spare contacts on the implant to also drive the open / close contacts on the garage door if I wanted to.

Burn companies like this to the ground.

F*ck these assholes. Pardon my language but I can’t hold back. Someone somewhere decided that this was a problem worth solving? You can’t stop it and also say it affects a small number of users. Which one is it? Was it a noisy neighbor problem?

I used homebridge for years and now this nonsense.

Maybe someone can build an SDR version that simulates the garage door remote? Then these jackasses can’t stop it.

Does anyone know how they were able to stop third party use? Certificate pinning to the API?

ratgdo [https://paulwieland.github.io/ratgdo/] already exists and works great.

For the current roadblock, it appears it was due to cloudflare bot protection [https://community.home-assistant.io/t/the-current-state-of-m...]

Ordered it, thanks. I saw it in the article too.

Glad people like this exist.

I haven’t previously heard about the ratgdo, but I recently did this myself with an ESP8266, relay, garage door remote, and Tasmota for the firmware. It works flawlessly with MQTT/Homeassistant. The individual components (excluding the opener) are < $10.

You are missing the beauty of the ratdgo. The ratdgo has open source firmware that implements the encrypted serial communications needed to control and get status (open/opening/closed/closing) from Chamberlain / Liftmaster garage doors (without needing the myQ hub).

There's also this, which I have used successfully for a while now with an old opener.

https://opensprinkler.com/product/opengarage/

+1 for OpenSprinkler! I have their sprinkler controller. Works with Home Assistant, it's awesome.

I don't have a garage door, but if I did, I wouldn't hesitate getting this one.

One good thing still about Chamberlain garage door openers is that the screw terminal to wire up the wall switch is still accessible. So when I recently had my garage door replaced, I never bothered to activate the MyQ crap that came with it. I simply wired up my old Z-wave garage door opener module and sensor via two small wires to the two terminal screws. Then paired the module to HASS.

Of course, I wouldn't be surprised if one day companies like these block access to the terminal leads for the wall switch and replace it with some proprietary cable connector and switch.

Along with a right to repair, we should have a right to interoperate with anything we own.

And if that means not running all traffic through the cloud, all the better.

ratgdo is the perfect bridge for folks who want local-only control -- it can even read the open/close/light state off the signal wires.

Oh, it's smart all right. They want you to use their app that has ads all over it.

This is a perfect example of why remote attestation is an evil technology. Here it is being used to make people their lives objectively worse.

This didn't involve remote attestation.

Well, there's a remote, and I'm sure many people will attest to its lack of function, so I suppose it qualifies on both counts?

It does. Their app does a check of the device to see if it looks legitimate, otherwise the APIs lock you out.

That's not what's happening, unless you have a source. They're now only allowing API calls from specific approved integrations like ITTT.

You can look inside the app and see that it's using Firebase for this

Read the link, they are using firebase app check which is remote attestation.

What link? No link that I can find mentions anything about MyQ and remote attestation.

Seems HN changed the link. the developer of the extension explains it on the home assistant forum. They are using firebase app check which uses remote attestation.

Tough room. Have deployed three of these- for every HN IFTTT-style user lamenting the API's death, there's approximately 99,345,223 of the rest of us who use the accompanying app to open/close our garage doors and let us know if we forgot to close them; Chamberlain taking a "don't let the garage door drop down on your ass on the way out" stance probably won't even make a noticeable blip in sales.

It's the H in HN, my friend.

Reply on news.ycombinator.com