I'm guessing that like the Nest thermostat they have an external web site (nest.com) you can register the device with, and then perform config via that site.

I wonder if anyone's sniffed their Nest's traffic to see if it's encrypted?

Ha ha, only on HN will this be asked ;-)