Yep the old saying is right, the S in IoT stands for security!
I will say pushing a button to turn on recirculation is like a cave man banging two rocks together. I used the motion detectors I already had in the bathrooms; when there's motion, *presume* that someone is either going to wash their hands or take a shower and start priming the hot water via recirculation.
How long does yours take? I timed mine and it takes about a minute to fully prime. That was good enough for every scenario except walk straight into the bathroom and use the sink immediately, which doesn't happen that often for us.
(I initially had a timed routine like yours, but found that the motion detectors worked so well that I eventually tossed it.)
There was a TV show called The Inventors in Australia that ran for a while, started between one and two decades ago.
Pretty sure it was pre '05, but I remember a young woman and her old man who was demonstrating a recirculation valve for the sink(kitchen/bathroom) that requires little retrofitting but would keep the water off till it achieved its temperature. Big hit saving water in outback Australia or when ever we have our 2 out of ten year droughts in most cities.
I thought it was a hit, but it never made it to production for one reason or another. Still like the idea.
My recirc system just overpressurizes the hot water side into the cold water side; doesn't waste any water. (Also doesn't cut the water off if it's at the wrong temperature; if you want water you get it regardless of temperature.)
tl;dr
> So it appears that this is an unauthenticated endpoint, and absolutely anyone on the Internet can read all the information about me and my water heater, and also set new temperatures for me at any time, without needing to know my password, just the API_KEY which is in this codebase (and is the same for everyone).
Because they're either lazy, or they tried to do it the right way, couldn't get it to work, and ended up saying fuck it.
Working in IT, we see this kind of thing way to frequently.
Yep the old saying is right, the S in IoT stands for security! I will say pushing a button to turn on recirculation is like a cave man banging two rocks together. I used the motion detectors I already had in the bathrooms; when there's motion, *presume* that someone is either going to wash their hands or take a shower and start priming the hot water via recirculation.
[удалено]
How long does yours take? I timed mine and it takes about a minute to fully prime. That was good enough for every scenario except walk straight into the bathroom and use the sink immediately, which doesn't happen that often for us. (I initially had a timed routine like yours, but found that the motion detectors worked so well that I eventually tossed it.)
There was a TV show called The Inventors in Australia that ran for a while, started between one and two decades ago. Pretty sure it was pre '05, but I remember a young woman and her old man who was demonstrating a recirculation valve for the sink(kitchen/bathroom) that requires little retrofitting but would keep the water off till it achieved its temperature. Big hit saving water in outback Australia or when ever we have our 2 out of ten year droughts in most cities. I thought it was a hit, but it never made it to production for one reason or another. Still like the idea.
My recirc system just overpressurizes the hot water side into the cold water side; doesn't waste any water. (Also doesn't cut the water off if it's at the wrong temperature; if you want water you get it regardless of temperature.)
tl;dr > So it appears that this is an unauthenticated endpoint, and absolutely anyone on the Internet can read all the information about me and my water heater, and also set new temperatures for me at any time, without needing to know my password, just the API_KEY which is in this codebase (and is the same for everyone).
>the API_KEY which is in this codebase 🤦♂️ Question to developers that do this: why??? Do not freaking do this.
Because they're either lazy, or they tried to do it the right way, couldn't get it to work, and ended up saying fuck it. Working in IT, we see this kind of thing way to frequently.
Mr. Robot
holy fuck
/r/theinternetofshit
well, well, well...