You would have to be insane to buy a computer that remains someone else's computer...
I found a backdoor into my bed
61–70 of 403 posts
Re: I found a backdoor into my bed
#62Earlier quoted context omitted.
> It won’t function if the internet goes down Come on. We can improve that! The next version of the bed will go into carnivorous mode if the subscription lapses: https://www.youtube.com/watch?v=vXrAK6sUZ_0
I'm thinking a Thomas Midgley, Jr.[0] mode. [0] https://en.wikipedia.org/wiki/Thomas_Midgley_Jr.#Death
Thomas has three different inventions with a massive body count. The last one had a fatality rate of 100%.
Re: I found a backdoor into my bed
#63While we're all here, what are some good alternatives to Eight Sleep? The idea seems to have merit but the required IoT subscription is a dealbraker.
I use one of their competitors (Sleepme Ooler) but they're not great either. Did not know about aquarium chillers, that seems like a better option. Could probably pair it with Home Assistant too if you wanted to more easily set the temperature.
Re: I found a backdoor into my bed
#64The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…
Software is devil-is-in-the-details to the extreme, and maximally opaque even to programmer-capable consumers, much less general consumers. And all tech companies are now founded with zero regard for good behavior. I mean, they don't even do minimal amounts of customer service, which is the bare minimum of having regard for your customers. In general, the IoT industry has suffered and adopters get burned over and ove…
You could probably extend from medical devices to children’s toys. And once those are entrenched, go after the rest.
Re: I found a backdoor into my bed
#65You would have to be insane to buy a computer that remains someone else's computer...
[flagged]
Re: I found a backdoor into my bed
#66A $20/month bed subscription is objectively hilarious. I cant imagine how this company attracts a non-zero number of clients.
Re: I found a backdoor into my bed
#67Earlier quoted context omitted.
I used to work for match.com and we had a readout in the office that streamed customer feedback. 90% of it was people who had paid subscriptions complaining about intrusive advertising on the site or in the app while logged in. I raised this at a meeting and was told that they weren‘t going to change it because it made too much money. I’m sure engineers raised issues about this as well and were shut down by the busin…
Respectfully, raising an issue isn't the same as taking a stand.
At the very least, many products have unpopular features that are easier than one might expect to disable. And that’s quite often down to a developer who disagrees creating or leaving a covert channel lying around to circumvent the feature. Their boss didn’t tell them to put it in, and they didn’t tell anyone about it so that it was insubordination if they didn’t agree to take it out. Just a little something we accidentally left in for debugging or PoC purposes. Whupsie!
Re: I found a backdoor into my bed
#68The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…
I wonder if there'd be a cottage industry for new control boards which de-shittify IOT devices but keep their functionality. Like buy the bed, and then buy a little pre-programmed ESP32 logic board to replace the factory board.
ESPHome fills much of this niche for me. It's a framework for turning YAML device definitions into custom microcontroller firmware, with myriad supporting tools. The official device database at https://devices.esphome.io lists 554 devices but that's nowhere near the end of it.
Most manufacturers bolt on IOT functions by dropping an off-the-shelf module onto their device-specific board. It's sometimes possible to replace the factory firmware with ESPHome, sometimes even using over-the-air updates. For example, AirGradient air quality sensors: https://github.com/MallocArray/airgradient_esphome
Even when it isn't possible to commandeer the factory IOT module, the fact that it _is_ a module is still useful, because it's almost always possible to inhibit or remove the factory module and connect your own instead. The factory IOT module controls and senses the device, so your replacement module can too, using the same pins. For example, an IOT air filter: https://github.com/mill1000/esphome-winix-c545#final-assembl...
Some devices are designed around multidrop communication busses. These are usually even easier, since the ability to join the bus is an intended design feature, even if the device you're using is not intended. For example, many Samsung residential HVAC systems: https://github.com/omerfaruk-aran/esphome_samsung_hvac_bus/d...
Re: I found a backdoor into my bed
#69The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…
I wonder if there'd be a cottage industry for new control boards which de-shittify IOT devices but keep their functionality. Like buy the bed, and then buy a little pre-programmed ESP32 logic board to replace the factory board.
I feel like websites like https://www.tindie.com could definitely fill that gap. It's like an Etsy + Hackaday where people sell different levels of hardware etc.
Re: I found a backdoor into my bed
#70I have an EightSleep from before their enshittification into a subscription model. It is a good piece of hardware, but I can no longer recommend it because the software is so crappy. I checked the logs on my router and found that it was streaming tons of data to servers even when I wasn't using it. I have no idea why it would stream that much data since the trivial sensors it has shouldn't be producing that much data…
Maybe this guy isnt the first person to discover the backdoor and your mattress has been mining crypto. This whole thing is straight out of a Cory Doctorow novel.