Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking my “smart” toothbrush

kuenzi.dev

Post reply on HN
Print view View original

81–90 of 311 posts

Re: Hacking my “smart” toothbrush

#81

Post by cyberge99 »

SV_BubbleTime wrote: post #42
brianleb wrote: post #16

Earlier quoted context omitted.

It works /right now/. Revisit this comment in 3-5 years and see if the behavior of new brushes and brush heads has changed for the worse...

It can’t be far off that they ship a BLE or Wifi enabled Sonicare that reports your best brushing habits to the app that then posts it on Facebook for philipPoints you compete with your friends on… oh shit… what have I done!? Anyhow, blocking unofficial heads is just an OTA firmware update away.

The Sonicare App already reports your brushing areas and how long you brush and other metrics. It wouldn’t be hard to add a “post to FB feature” (but let’s hope they don’t).

Re: Hacking my “smart” toothbrush

#82

Post by arrowsmith »

qingcharles wrote: post #44
mikestew wrote: post #4

Great article, the most interesting part of which is that you can lock your self out of your toothbrush head after three wrong password attempts. I didn't dig into the data sheet for the NFC chip very deeply, but I imagine that it's just the default that the chip ships with. Or maybe Philips really wants that $25 for a new toothbrush head. :-) EDIT: nope, not the default. From the data sheet, last sentence: "To preve…

Welcome Time Travellers! This is 2023 where you can find yourself locked out of your toothbrush after too many failed password attempts.

How long's it going to be before "smart" toothbrushes become the only option? Should I start stockpiling "dumb" toothbrushes now while I still can?

The other day I was trying to buy a pair of bathroom scales and it took me far too long to find one that just, you know, weighed things without also demanding I connect it to the Wi-Fi and download a smartphone app. How is this an improvement?

Re: Hacking my “smart” toothbrush

#83

Post by roundandround »

nneonneo wrote: post #21
roundandround wrote: post #3

I'm curious to see, but I don't think the algorithm for calculating the password from the identifier would be very sophisticated. Assuming they didn't want to add costs to prevent easy retrieval of any secret key from the device, a complex algorithm would be kind of a waste.

I mean, even something as simple as `md5("very-long-secret-only-phillips-knows" + uid)[:4]` would be effectively unguessable. Not hard if you have the code for the firmware, but nigh-impossible otherwise.

If one person has access once and publishes it, the work of setting up a proper md5 was a waste compared to an xor.

Re: Hacking my “smart” toothbrush

#84

Post by [deleted] »

arrowsmith wrote: post #82
qingcharles wrote: post #44

Earlier quoted context omitted.

Welcome Time Travellers! This is 2023 where you can find yourself locked out of your toothbrush after too many failed password attempts.

How long's it going to be before "smart" toothbrushes become the only option? Should I start stockpiling "dumb" toothbrushes now while I still can? The other day I was trying to buy a pair of bathroom scales and it took me far too long to find one that just, you know, weighed things without also demanding I connect it to the Wi-Fi and download a smartphone app. How is this an improvement?

[deleted]

Re: Hacking my “smart” toothbrush

#85

Post by mrfumier »

charles_f wrote: post #67

I kind hoped the conclusion would be that you could unlock hidden features in the brush head, increase the torque and reset the head so that you don't have to replace it. But alternatively, since the head has an NFC tag, could you use it for stuff like a partnership with Marriott (open your hotel door with your toothbrush, so much convenience) or with transit companies to charge your monthly transit pass? Possibiliti…

The toothbrush doesn't force you to change the head. You can brush your teeth with an old head as much as you want.

Re: Hacking my “smart” toothbrush

#86

Post by mrfumier »

rendaw wrote: post #47
AlbertCory wrote: post #6

I have one, but it never occurred to me to want to hack it. "But how do you know when it's time to change the brush?" Well, how about when it starts getting soft?

I swap toothbrush heads 4-5 times a day (a couple times per brushing session) and one of my major issues until now was that I didn't know how long I had used any individual toothbrush head and when to replace them (I didn't start using all of them at the same time). With per-head usage tracking this is much easier... I wasn't expecting it, but I'm glad Phlips is considering and supporting my use case.

I think the use case is a family using the same electric toothbrush with a different head for each member.

They used to provide color rings to attach to the head, in order to differencing.

Re: Hacking my “smart” toothbrush

#87

Post by jackvalentine »

arrowsmith wrote: post #82
qingcharles wrote: post #44

Earlier quoted context omitted.

Welcome Time Travellers! This is 2023 where you can find yourself locked out of your toothbrush after too many failed password attempts.

How long's it going to be before "smart" toothbrushes become the only option? Should I start stockpiling "dumb" toothbrushes now while I still can? The other day I was trying to buy a pair of bathroom scales and it took me far too long to find one that just, you know, weighed things without also demanding I connect it to the Wi-Fi and download a smartphone app. How is this an improvement?

> The other day I was trying to buy a pair of bathroom scales and it took me far too long to find one that just, you know, weighed things without also demanding I connect it to the Wi-Fi and download a smartphone app. How is this an improvement?

First site I went to, first search term I tried.

https://www.target.com/s?searchTerm=scales

Re: Hacking my “smart” toothbrush

#88

Post by josephcsible »

Semaphor wrote: post #71
josephcsible wrote: post #26

Earlier quoted context omitted.

> Because it's a feature customers ask for? Aren't switches to temporarily bypass emissions controls in cars illegal, despite being a feature customers ask for? > What laws do you want written? I want all e-fuses to be banned, as well as any other means for manufacturers to permanently reduce, restrict, or remove functionality from products after they've been sold. > How "secure" am I allowed to make my product befor…

> I want all e-fuses to be banned, as well as any other means for manufacturers to permanently reduce, restrict, or remove functionality from products after they've been sold. One thing, I can think of, are hardware-based security devices that disable themselves after recognizing break-in attempts.

What kind of devices do you mean exactly?

Re: Hacking my “smart” toothbrush

#89

Post by fencepost »

jrockway wrote: post #12
mikestew wrote: post #8

Earlier quoted context omitted.

How about when the blue part goes away, as documented? :-) I've used a Sonicare for, what, ten years or more? And I don't think I've ever seen an indication that the NFC is communicating anything to me. That's not to say that it isn't, but if I'm going to ignore something[0] and replace the head when I damned well please, I just ignore the blue part of the bristles. I could probably adjust my behavior to ignore whate…

I just change the brush head on the 1st of every month. They say it lasts for 3 months, I must press too hard. So it goes.

Pressing too hard likely makes it much less effective. With the Sonicare brushes you're supposed to let the vibration do the work, and just like holding the cone of a speaker still you're not getting the vibration that does the job.

Re: Hacking my “smart” toothbrush

#90

Post by Zeyka »

TheCaptain4815 wrote: post #55

I’ll never forget when my damn sonicare toothbrush app warned me about my iPhone being jailbroken. Had to have been a troll by the creators of the app since not even some of my banking apps had that warning.

When I rooted my android phone a few years back, all of my banking apps worked (I had to use magisk hide for some I think) but the only app that would not work was the Macdonalds app... Not that I needed it, I never go there, but I thought it was funny that their app was more "secure" than some banking apps.
Post reply on HN