The installer who set up my heat pump created a Gmail account on a tablet they provided, then used it to set up an account for the heat pump.

[marshray@infosec.exchange]

@ryanc (F) Installer left the spreadsheet with all their customers’ email addresses and password(s) open on the web and your HP was banned for sending spam and ddosing

[ryanc@infosec.exchange]

@aimaz I'm sure they'll at least have a bot tell me that I've been a naughty enby and that I know exactly what it did.

[miah@hachyderm.io]

@ryanc

Good luck! This sounds like _hell_.

[trantion@masto.ai]

@ryanc I voted for "Google says " then immediately remembered that Google never says anything to their users

[ryanc@infosec.exchange]

@tezoatlipoca There is no "can't", only "haven't been persuaded yet". I have bullied an airline into having an engineer manually edit their database for me.

[ryanc@infosec.exchange]

@ljrk The management app requires "the cloud", and I haven't gotten around to reversing the control plane (which is not encrypted) yet

[ryanc@infosec.exchange]

@marshray It's on its own VLAN with egress filtering, I am not an amateur.

[ryanc@infosec.exchange]

@trantion "Google's automaton says"...

[acsawdey@fosstodon.org]

@trantion @ryanc It's implied when they ghost your request for help ...

[ryanc@infosec.exchange]

@miah It will make a fantastic example for the "don't fuck it up" section of the next anti-fraud talk I give.

[ryanc@infosec.exchange]

@acsawdey @trantion also that

[fritzadalis@infosec.exchange]

@ryanc @dangoodin
I think that last one is all but guaranteed at this point.

[mansr@society.oftrolls.com]

@ryanc Why does a heat pump need a Gmail account?

[ryanc@infosec.exchange]

@mansr fucking cloud bullshit - doesn't have to be a gmail account, just needs a working email address and password

[ryanc@infosec.exchange]

@mansr it speaks some unencrypted protocol to the server so I should be able decloud it...

[philip@mastodon.mallegolhansen.com]

@ryanc Does one dare ask why the installer would think that was the right course of action?

[rotopenguin@mastodon.social]

@philip @ryanc does one dare ask why the manufacturer made this necessary?

[ryanc@infosec.exchange]

@rotopenguin @philip As to the manufacturer - incompetence and/or rent seeking. All of the other tech in my house works without Internet access.

[simonzerafa@infosec.exchange]

@ryanc

I'm going for the last option as that's the coolest outcome.

But in all probability the actual solution will be the least interesting one ‍️

[m0yng@mastodon.radio]

@ryanc when mine was installed I got as far as the log in / create an account page of the manufacturer (daikin) one option was Facebook.
Why in the fuck would I use a Facebook account to control my house heating?
Tldr, my heat pump does not connect to anything and I have to go into the garage and adjust settings manually.