I upgraded my water heater and discovered how bad smart home security can be | Hacker News Reader

I upgraded my water heater and discovered how bad smart home security can be

arstechnica.com

28 pointsrntn28 comments

This functionality seems completely unnecessary to me.

I just had a Navien tankless heater installed and the recirculating feature works wonderfully and needs no IoT app or internet connection at all.

It feels like we are in a wilderness period right now where every appliance wants its own app, with online account, which is just a supercharged way to get more personal data from their customers.

I also have a GE dryer with its own app. The functionality isn’t even good. We can see the settings remotely and get a notification when the cycle is complete.

In exchange for this essentially useless feature, GE gets a complete history of our laundry cycles, any info shared by my mobile device, and advertises to us.

Security is only a part of this mess.

> It feels like we are in a wilderness period right now

Not really. I bought a house with a lot of deferred maintenance and am replacing a lot of systems to get it back in good order. I just tell various vendors/salesfolk/installers "no thanks, I prefer a dumb home" and none of them miss a beat. Usually they'll tell me a story or two about the "smart" version of their product failing to live up to the "smart" moniker. And we all move on with our lives.

The only pushback we ever got was from a solar installer but we had already decided the contract terms were a non-starter, so we just told him to take a hike at that point.

I need to replace my existing tankless water heater and plumber uses Navien. They offer multiple modules to start recirculating including hardwired button, led screen control and of course and IoT capabilities. I considered the button for convenience and IoT module just to integrate with the rest of house, keeping preference for physical when adding Smart Control.

I added door sensors to my LG washer and dryer. Along with access to their platform for knowing when the machines run and complete I have some logic of whether clothes are present or at least the door not opened. Haven’t done too much with it as I need better dashboard and visual indicators somewhere that is visible to everyone.

I have 3 LG dryers which support notification via app when a cycle is complete. I find this feature extremely helpful and am more than willing for LG to have my laundry data in exchange. 1 dryer is in my home where the laundry room is far enough away from the main living spaces that the audible notification can’t be heard. The other 2 dryers are located in the tack rooms of the 2 horse barns on our property. Washing of the saddle pads usually takes several loads and knowing when one load is done so the next can be immediately moved to the dryer is very helpful.

>It feels like we are in a wilderness period right now where every appliance wants its own app, with online account, which is just a supercharged way to get more personal data from their customers.

It's also software-imposed planned obsolescence. If you think an appliance manufacturer is inclined to maintain software and servers for the functional life of the hardware, then I have a bridge to sell you.

The author of the article seems to think that tankless heaters will deliver hot water more slowly to taps than a traditional tank heater would. That's not the case. Having to wait for the hot water to come out of the tap is due to the distance between the tank (or tankless heater) and the tap. Nothing else. You'll also have to wait a long time if you're trying to get hot water from a tank that's on the other side of the house.

One solution are recirculation pumps, which the author goes on to describe, which keep pulling hot water through the pipes. Another solution would be to have a mini-tankless heater directly beneath the sink. For some reason those are much more common in Europe than the US. If the tankless heater is very close to the tap then you're going to get hot water almost immediately.

From what I’ve heard, his understanding is correct. It takes a few seconds from when the unit clicks on until the water gets hot. It’s a longer delay for electric than gas.

I had a gas tankless heater for about 20 years and hot water came out of pretty much instantly. But it makes sense that electric tankless heaters wouldn't have the same kind of speed.

The author is wrong. I live where the ground water is cold and I replaced a large tank with a tankless system in the same location. The hot water reaches the show as quickly as it ever did.

+ Tankless water heater mounted inside a garage so it doesn't freeze (and the type with an anode rod to last longer, and check it)

Also:

+ Short and insulated outdoor faucets

+ Whole house filter* ahead of all indoor water

+ Regenerative water softener applied to all indoor hot and cold lines except for the kitchen main sink

+ RO filter + permeate pump** + UV under kitchen sink applied to tap and refrigerator

+ Water hammer arrestors where needed

+ Recirculating hot water loop (3 pipes) to begin with

+ If you're feeling extra spendy and don't want even the possibility of nasty shit from tap water in your plants, a carbon block filter just after the water meter

* 3 big 20" filters in series with a pair of bypass valves and a bypass line

** Critical to reducing waste during production

The "S" in "IoT" stands for security

And the “P” stands for privacy

Is waiting a moment for hot water to fill the pipes really so inconvenient?

US houses can run pretty big, so there can be quite a lot of cold water to flush out of the pipes before hot becomes available; especially for something like a morning shower. That can mean tens of gallons of water gone straight into the drain and quie a few minutes of time lost in what many already find to be a pressured morning routine.

Recirculators themselves can make a lot of sense for some people.

But they don't need IoT nonsense, nor the security and durability problems it invites.

Half inch pipe holds roughly 1/100 of a gallon per foot.

10 gallons would be hundreds of feet of piping.

The only truly smart thing in this thread.

I think the 10 gallons is probably about right. People start the sink or shower going and then go do something else, wasting much more hot and cold water than necessary.

You can stop most of the hot water waste in that situation with one of these [1]. It's a valve that you put ahead of the shower head. When it senses that the water has warmed up to 95℉ it reduces the flow to a trickle until you turn a lever to restore full flow.

[1] https://www.showerstart.com/products/showerstart-tsv3

It takes about a minute for our shower to get hot maybe less. I basically have time to pee. This is just as fast or slow as was the case for our tank based heater, only now it runs forever and with 4 girls in the house we would never trade back. We also have a big house even by american standards

Re: your morning shower example.

People seem to make the mistake of setting the mixer valve to their desired temperature position, routing to the shower head, turning on the water, and waiting for the water to reach temperature. That takes a long time, and wastes water. Probably not 10s of gallons, in an ordinary house, but 7-8 would not surprise me.

The more efficient procedure is to turn on hot water only, routed to the tub spout only, for ~15 seconds until water is flowing hot. Then move the valve to the desired temperature position, and divert to the shower head. This wastes about 2 gallons.

A tankless water heater wastes zero gallons, but it requires a gas pipe to the bathroom.

> Because it doesn’t keep a big tank of water heated and ready to be delivered to any house tap, tankless water heaters save energy—up to 34 percent, according to the Department of Energy.

Yes, perhaps compared to electric heated tanks - though the latter require a lower continuous power and can be planned against peak demand.

However, heat pump water heaters which dump their heat in a tank are much more efficient.

I’m starting to just build my own stuff. Currently trying to make an IOT lamp from individual SMD LEDs plus esp32

I mean there's no guarantees it'll be any safer because of a lack of outside audits or hackers finding out about it, but it will be safer because it's a one-off and unique implementation, instead of a known weak system with countless users that could all be affected.

I agree on the “guarantee” if read pedantically. But I can at least use proven frameworks for authentication and even integrate passkeys. I might do it wrong, of course, but there’s an incredibly, extremely high chance that it will be safer than the API in TFA which was known to only use email address string regurgitation as its sole authentication.

Security Through Obscurity deniers are screaming like banshees right now.

Well for starters it’s local network only so I’d argue that it is objectively safer than whatever shitty app/cloud thing IOT suppliers rolled.

Worst case I just firewall the ip of the ESP32 off but frankly o haven’t bothered

But yeah the aliexpress ESP32 could be compromised or ESPHome could be but those are dice I’m willing to roll

Smart Home (in)security, Smart Home (non)interoperability - it's a mess!

> It just irked me

Famous last words here

Reply on news.ycombinator.com