Extracting my data from the Hello Sense sleep tracker

#1

Post by lazyjeff » Thu, May 11, 2017, 6:49 AM UTC

Extracting my data from the Hello Sense sleep tracker
jeffhuang.com

Re: Extracting my data from the Hello Sense sleep tracker

#2

Post by necklace » Thu, May 11, 2017, 7:28 AM UTC

That's great, but why don't you have HTTPS/SSL on your website, jeff?

Re: Extracting my data from the Hello Sense sleep tracker

#3

Post by kalev » Thu, May 11, 2017, 7:32 AM UTC

And you just gave us their segment.io API key and google cloud manager authentication tokens.

Re: Extracting my data from the Hello Sense sleep tracker

#4

Post by fredkelly » Thu, May 11, 2017, 7:43 AM UTC

Amazing, I've been wanting an API since I first got mine through the Kickstarter!

Re: Extracting my data from the Hello Sense sleep tracker

#5

Post by lazyjeff » Thu, May 11, 2017, 7:48 AM UTC

kalev wrote: post #3

And you just gave us their segment.io API key and google cloud manager authentication tokens.

You're right, I've fuzzed those out but anyone can still pull it out of the app. Seems like a bad idea to have those hardcoded client-side, so I'm not sure why Google requires developers to do this.

Edit: actually I think the value that is exposed is the token ID, not the token itself. I haven't used Google Cloud Manager before myself, so maybe someone can confirm.

Re: Extracting my data from the Hello Sense sleep tracker

#6

Post by robbiet480 » Thu, May 11, 2017, 9:06 AM UTC

Been waiting for an API for years now, sadly don't expect one to come anytime soon. Luckily their private API is standards based and has year+ access tokens!

Re: Extracting my data from the Hello Sense sleep tracker

#7

Post by bendbro » Thu, May 11, 2017, 9:39 AM UTC

necklace wrote: post #2

That's great, but why don't you have HTTPS/SSL on your website, jeff?

Why is https necessary here?

Re: Extracting my data from the Hello Sense sleep tracker

#8

Post by wccrawford » Thu, May 11, 2017, 11:55 AM UTC

bendbro wrote: post #7

necklace wrote: post #2

That's great, but why don't you have HTTPS/SSL on your website, jeff?

Why is https necessary here?

It's not, but there's a serious trend towards a security-first mindset. IMO, the idea is that if everything is secured, nothing forgets to be secured, or is left un-secure accidentally.

There are also those who simply don't want people knowing what they're reading online, even if it's just programming blogs or other "harmless" stuff.

Re: Extracting my data from the Hello Sense sleep tracker

#9

Post by jacobwg » Thu, May 11, 2017, 12:17 PM UTC

bendbro wrote: post #7

necklace wrote: post #2

That's great, but why don't you have HTTPS/SSL on your website, jeff?

Why is https necessary here?

Without https, a man in the middle could easily rewrite your website's content in different ways for different purposes, inject scripts, etc. Which at first sounds a little theoretical except that ISPs have actually done this to inject banner ads into unsecured pages (article's about a smaller ISP, but iirc Comcast has done this before as well): https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-...

Re: Extracting my data from the Hello Sense sleep tracker

#10

Post by dublinben » Thu, May 11, 2017, 1:33 PM UTC

If you're looking for a cheap, hackable device with basic sleep tracking, I highly recommend the Xiaomi Mi Band (1 or 2). The protocol has been reverse engineered, so you can use a program like GadgetBridge to get all of your raw data out of the device.