Hacker News Reader

Comment by UberFly | Hacker News Reader

I would be worried about putting anything Xiaomi into my home. They have repeatedly proven to be a major privacy concern. Maybe security concern as well.

View on HN

> They have repeatedly proven to be a major privacy concern. Maybe security concern as well.

Thanks to Zigbee being a standard, you can use a Zigbee hub/adapter from any vendor you like. The Zigbee sensors themselves have no network connection and therefore noway to warrant privacy concerns really. There is no WiFi/Ethernet or internet involved with anything Xiaomi here.

I'm using a bunch of these Aquara Zigbee sensors with the open source Home Assistant software and hardware, they are for the most part fantastic.

I would take Zigbee home automation devices over crappy wifi ones any day of the week - its a vastly better protocol/methodology for hooking these sorts of devices up. Your home's lights functioning properly ideally should not depend on bulbs/switches being able to get an IP address etc (sigh)...

> https://www.home-assistant.io/skyconnect - USB adapter for Zigbee from HomeAssistant you can plug into any box you like.

> https://www.home-assistant.io/yellow/ - HomeAssistant server hardware with Zigbee radio built in.

The Aqara temperature sensors[0] wouldn't stay connected to my SkyConnect USB dongle. No issues with my Zigbee switch and thermostats though, so I think some vendors aren't fully Zigbee compliant but it's probably the exception.

[0] https://www.amazon.com/gp/product/B07D37FKGY/

I've had great results with their buttons/light switches and Home Assistant Yellow, and the SkyConnect prior to that, for what its worth. I especially like the PoE version of Home Assistant Yellow - can power the entire server from its ethernet port.

What would you recommend for a ZigBee thermostat?

I'm not who you asked, but I replaced my baseboard heater thermostats with the Sinope Zigbee ones and have been very happy with them. I think their products only work with heating systems though, not heat + A/C.

https://www.amazon.com/gp/product/B07PQTF53D

Do you use ZHA? I had to change to zigbee2mqtt (and thus get more compatible device to go with it) to make my Aqara sensors stop disconnecting.

Probably? It's a SkyConnect on Home Assistant OS.

That is a valid concern, but not such an issue with Zigbee stuff since you can run it with your own hub giving the sensors 0 external connectivity.

Their sensors are fine, just use a non-Xiaomi hub like SONOFF Zigbee 3.0 USB Dongle.

Sonoff is chinese, doesn't fix the security issue

What's the threat model for a usb dongle? It won't have network access... I suppose it could spontaneously become an HID device and try typing its way to trouble, but that'd be very OS-specific...

USB is like the most well known physical threat. Look up OMG Cables.

Right, but that's intended for the attacker to connect to from nearby? Also of course presumably if it's got enough hardware crammed in there to cost $170 random Chinese tech companies are not going to include all of that in their $25 dongle "just in case" you turn out to be worth compromising?

I think you are overestimating the cost of inclusion. Surely you have had mandatory IT training about not plugging in unknown usb drives at work right?

Yes, but my work laptop is not a Zigbee hub that I randomly plug unknown USB devices into.

I am more worried about US stuff with the whole PRISM thing and other three letter shenanigans.

Aditionally the comment you are replying to is a dongle to provide a single board computer (or a computer in general) with ZigBee conectivity.

Ideally you would run a trusthworthy open source OS and hub software.

Agreed, I would rather a foreign agency with no power or authority over me to have my personal data than a government that has the authority to wrongfully tax, investigate, jail, prosecute, and imprison me for that same data.

Now I'm imagining a self destructing roborock vacuum burning down my house when China goes deep in anti US territory.

Best policy I abide by is to prevent any data from exiting my network or remote control period. I don't care who is spying.

Most likely you won't have that problem because the power grid will be offline.

You should choose the devices that are the most secure, using the information you have available at the time.

Choosing a foreign government to spy on you rather than your own government isn't a clear choice. While a foreign government is less likely to be interested in you personally and likely less able to directly cause you harm, you also have less recourse against them than against your own government and their interests are less likely to be aligned with yours.

Additionally, your government may be able to co-opt the compromised devices anyway and would certainly have an incentive to do so.

I'd also question that a device that is by-design-compromised is otherwise secure from bad actors. It is difficult to imagine the incentive structure that would make that possible.

Finally, once this personal data has been harvested by either government, there is nothing to stop these governments or rogue elements within these governments from trading or sharing that data with your own government or other actors.

I don't chose to be spied on by any government! But if I could chose only one, it would be an opposing country like China or Russia.

American businesses are forced to share our private data witn three letter agencies. Conversely, I can't imagine any leverage, money or lawful, that would cause a Chinese citizen living in China, with families in China, to be so stupid as to collaborate with the US government in any way, unless they wish for their families to be sent to labor camps.

My data is safer with the Chinese. I don't like it, but that's where we stand with our privacy.

The problem is that the American government has shown time and time again that their interests are not in any way, shape, or form aligned with that of the public.

At this point, I’d trust a (likely) disinterested state actor over one that has been proven to be actively malicious.

A dongle loads drivers through USB fyi.

If you're more worried about the US then China, we must live in a different world :)

My Sonoff Zigbee dongle presents itself on my Linux home server as a USB serial device (/dev/ttyUSB0) which gets forwarded to the zigbee2mqtt container which talks to it. Perhaps under a different host OS it might try to deploy something nefarious, but I'm not particularly concerned.

And what about the non technical people, the majority :)?

Will they have the same setup?

Those people probably aren't buying USB dongles that depend on a server in the first place; They're using one of the many "hub" devices out there instead (with varying degrees of privacy and network security).

Why wouldn't they buy a zigbee USB dongle? ...

Because it presupposes owning and administering a server to host it, which seems like it would exclude someone from the "non-technical user" segment?

These Zigbee sticks don’t have much opportunity for naughtiness. Like others I’ve used, they communicate over serial with their host (no IP ), and are based on a TI chipset which you can flash.

As other's mentioned, they communicate via serial to the host, this is not a device I'd be greatly concerned about as a threat.

Unless you took great care with sourcing your electronics then they're already packed with chips/parts from china.

If you _really_ want to you can use a nRF52840 (Nordic Semi is from Norway), or I think a few TI chips (USA), and use those as a gateway instead with home assistant (might need to add an extra library). Even then, both companies have manufacturing plants in china AFAIK so...

That's the beauty of Zigbee. You can run your own hub if you want, and no information leaves your home. Of course this is less, or not at all, true if you run a manufacturer's hub.

All of my Xiaomi stuff is Zigbee and runs through Zigbee2MQTT, I'm not too concerned here since there's no Xiaomi stuff that's capable of connecting to anything except my Zigbee adapter.

It's zigbee.

Run your own Conbee stick and the value is off the charts.

I started with a Conbee plus deCONZ and it worked very well.

I've since switched to a SLZB-06[0] plus Zigbee2MQTT and it's incredible.

[0] https://smlight.tech/product/slzb-06/

I'm glad it's working well for gou.

What are the advantages of that over a Conbee?

My Zigbee network is completely flawless and the Conbee picks up pretty much any device.

Pretty hard to improve on that I'd think.

There were two things that pushed me to the SLZB-06:

* deCONZ was slow to get new device support and I had purchased some devices that weren't supported (Ikea STARKVIND) at the time. I think this has been improved since I last used it though.

* The SLZB-06 can be powered by PoE which gives it a lot more flexibility than anything connected by USB. Also, since it's not USB-connected, it's a lot easier to deal with (no need to figure out USB passthrough, etc).

I see, I appreciate the knowledge of your experiences.

I'm running HA in a host-privileged docker on my system so it's fairly ergonomic, I'm sure there's room for security improvement there, though.

Reply on news.ycombinator.com