The installer who set up my heat pump created a Gmail account on a tablet they provided, then used it to set up an account for the heat pump.

[ryanc@infosec.exchange]

@miah It will make a fantastic example for the "don't fuck it up" section of the next anti-fraud talk I give.

[ryanc@infosec.exchange]

@acsawdey @trantion also that

[fritzadalis@infosec.exchange]

@ryanc @dangoodin
I think that last one is all but guaranteed at this point.

[mansr@society.oftrolls.com]

@ryanc Why does a heat pump need a Gmail account?

[ryanc@infosec.exchange]

@mansr fucking cloud bullshit - doesn't have to be a gmail account, just needs a working email address and password

[ryanc@infosec.exchange]

@mansr it speaks some unencrypted protocol to the server so I should be able decloud it...

[philip@mastodon.mallegolhansen.com]

@ryanc Does one dare ask why the installer would think that was the right course of action?

[rotopenguin@mastodon.social]

@philip @ryanc does one dare ask why the manufacturer made this necessary?

[ryanc@infosec.exchange]

@rotopenguin @philip As to the manufacturer - incompetence and/or rent seeking. All of the other tech in my house works without Internet access.

[simonzerafa@infosec.exchange]

@ryanc

I'm going for the last option as that's the coolest outcome.

But in all probability the actual solution will be the least interesting one ‍️

[m0yng@mastodon.radio]

@ryanc when mine was installed I got as far as the log in / create an account page of the manufacturer (daikin) one option was Facebook.
Why in the fuck would I use a Facebook account to control my house heating?
Tldr, my heat pump does not connect to anything and I have to go into the garage and adjust settings manually.

[ryanc@infosec.exchange]

@M0YNG the installer, to their credit, has provided copies of all the manuals including service manuals and instructions for how to access the engineer menu

[rusozoll@layer8.space]

@ryanc I'd've voted for "Both Alphabet and the appliance manufacturer tell you to mound sand!"

[ryanc@infosec.exchange]

@rusozoll that's why voting for multiple options is allowed

[0x0ddc0ffee@infosec.exchange]

@ryanc As a last resort, unless the manufacturer was particularly diabolical, somewhere in the heat pump is an accessible point in the circuit where you can bodge-in your own relay to control the contactor that controls the compressor motor. If you roll your own temperature controller, don't forget hysteresis, or the compressor will cycle too often and fail prematurely.

[ryanc@infosec.exchange]

@0x0ddc0ffee I have over a dozen zones...

[inquisitive@mastodon.online]

@ryanc having helped my father get apps setup for monitoring his solar and his oil tank the entire field of "smart" installed hardware is made from garbage stuck together with bubblegum and razorblades.

[ryanc@infosec.exchange]

In a move surprising most of us, Google reinstated the account after reviewing my appeal.

Meanwhile, the heat pump company hasn't gotten back to me.

[khoos@infosec.exchange]

@ryanc keep us posted!
Especially on the finding a vulnerability part. I suspect a pwn2own entry in the future

[ryanc@infosec.exchange]

@KHoos I want to emphasize that I am absolutely not looking for a vuln.