The installer who set up my heat pump created a Gmail account on a tablet they provided, then used it to set up an account for the heat pump.

[ryanc@infosec.exchange]

@M0YNG the installer, to their credit, has provided copies of all the manuals including service manuals and instructions for how to access the engineer menu

[rusozoll@layer8.space]

@ryanc I'd've voted for "Both Alphabet and the appliance manufacturer tell you to mound sand!"

[ryanc@infosec.exchange]

@rusozoll that's why voting for multiple options is allowed

[0x0ddc0ffee@infosec.exchange]

@ryanc As a last resort, unless the manufacturer was particularly diabolical, somewhere in the heat pump is an accessible point in the circuit where you can bodge-in your own relay to control the contactor that controls the compressor motor. If you roll your own temperature controller, don't forget hysteresis, or the compressor will cycle too often and fail prematurely.

[ryanc@infosec.exchange]

@0x0ddc0ffee I have over a dozen zones...

[inquisitive@mastodon.online]

@ryanc having helped my father get apps setup for monitoring his solar and his oil tank the entire field of "smart" installed hardware is made from garbage stuck together with bubblegum and razorblades.

[ryanc@infosec.exchange]

In a move surprising most of us, Google reinstated the account after reviewing my appeal.

Meanwhile, the heat pump company hasn't gotten back to me.

[khoos@infosec.exchange]

@ryanc keep us posted!
Especially on the finding a vulnerability part. I suspect a pwn2own entry in the future

[ryanc@infosec.exchange]

@KHoos I want to emphasize that I am absolutely not looking for a vuln.

[bradrubenstein@infosec.exchange]

I have over a dozen zones...

Yep, it's always DNS.

@ryanc @0x0ddc0ffee