I have the pleasure of having been involved with one of the first network protocol reverse-engineers of the LIFX [0], and off the back of that hacked together a NodeJS library and a Wireshark dissector. I've updated the NodeJS lib to handle the new firmware (it does more over UDP, whereas it used to use a mixture of UDP and TCP) but not the dissector yet.

There's absolutely no authentication on the network protocol at all; as long as you're in the same network as the bulbs then you can send UDP packets and control the bulbs. I imagine this is a good and a bad thing; XBoxes automatically setting mood lighting when playing games etc... I'd rather they had to ask my permission before doing that, though.

[0] https://github.com/magicmonkey/lifxjs/blob/master/Protocol.m...