My wife thought I was being crazy for not connecting our Roomba to wifi when we bought it. I feel quite vindicated.
I recently moved into a new home and decided to take the opportunity to replace everything; it’s been surprising how many things are just coming to life. TVs, vacuums, kitchen appliances, etc. Some of my new TVs won’t even let me use the microphone on the remote until I give it my WiFi password. It’s quite ridiculous the world we’re creating for ourselves.
What brand?
Do you have any specific examples of a product doing this?
Couple days later, we had moved belongings and setup an old dumb TV for my kid. I was a bit surprised when then Apple TV had the WiFi credentials but I was busy moving and just shrugged it off.
Couple days later, I replaced the old dumb TV with a new Samsung. It had connectivity too, without doing anything specific. This isn’t my first smart TV but I never give any TV my WiFi and instead always use the Apple TV devices. So was a little more shocked on this one but thought I’ll figure it out when I setup my mesh.
Over the next few days, the JennAir appliances showed signs of connectivity. I wasn’t sure how. Hadn’t intended on giving them any Internet access. Don’t really care about having a smart oven.
About 2 weeks later, I get around to setting up the mesh. Start going device by device and having it forget the ATT routers Wi-Fi. None of the devices know my mesh info, so set them up individually. I need to just disable the ATT routers Wi-Fi network, haven’t yet.
I’m not really a networking guru. I just never had this happen before. I think I either accidentally allowed my phone to share the information or it’s possible my wife did. I had never used QR to login, so maybe that exposed something.
Sorry, what? That's not a documented thing.
There are limited ways in which you can share credentials (like between iPhones), and there have been some weird things in the past related to sharing with friends' accounts (the controversial Windows 10 Wi-Fi Sense in 2015), but your consumer devices aren't just sharing Wi-Fi credentials with each other. There isn't even a protocol for that kind of automatic discovery.
As for the microphone on the remote, you need to enable Wi-Fi on the TV so it can perform voice recognition on remote servers. The TV doesn't have the chips/software to do voice recognition. So that makes complete sense.
Also, pretty sure it’s undocumented, but I’ve been on a handful of reddits and HN conversations in the past where people are all experiencing this. I think a simplified theory is that they broadcast the WiFi credentials over Bluetooth and other unconnected devices can then get online. I remember one discussion of this theory where the guy found out his TV had connected to his neighbors WiFi somehow and this was a theory in the thread. It’s foil hat type stuff but very believable if you’ve experienced having devices know your WiFi despite having never granting it.
Another theory is similar where the unconnected devices send the connected device data to relay. This would allow the unconnected device to remain stealth, as it wouldn’t appear in your WiFi logs. There’s even a deeper level theory on this one where devices (particularly cheap Chinese toys and gadgets) come preloaded to exploit common vulnerabilities in other devices to establish this relay. Imagine a smart oven or fridge where the manufacturer has no incentive to keep up the firmware for security purposes. So now you have a baby monitor sending data to China through your air fryer’s WiFi connection.
There's no protocol for that over Bluetooth. One could be created, but it hasn't been yet. Nor for relaying data. These don't exist. Like, there are limited relays like what iPhones do for AirTags, but not for a vacuum cleaner to transfer data via your fridge to your neighbor's open WiFi.
In every case where someone's TV has mysteriously connected to a neighbor's WiFi, it's kids or the babysitter or someone else who actively tried to connect to watch a show.
Sadly, because of (2), most (all?) companies don't bother with local connectivity at all. Much easier to debug one codepath (via remote server) rather than two (remote server and direct connection).
So yeah, if you are worried about device being remote controlled by its manufacturer, don't buy devices which say "Can be remote controlled" right on the box. But of course then you are back to ancient tech, setting physical virtual wall devices or bounding the clean area with overturned chairs.
This is when you only want to clean only left half of the room, for example. In the old robotics vacuums, your choices were either enough physical "virtual wall" units (those little stubby boxes you place on the floor) or physically fencing it, with overturned chairs or boxes or something.
With the smart vacuums, you get the nifty map and you can draw the lines/boxes around the area you want cleaned. Very convenient, but naturally requires some sort of device with a screen (to show map) and position input (to draw the boundaries), like a phone.
Why couldn't that just be over Bluetooth?
The real madness is to think that data harvesting is not happening.