Couple of questions pre purchase

[Abscam]

OK. I’ve been all over the wiki and this site and ready to pull the trigger but looking for some input. Thanks for your considered responses.

1. Are you satisfied with micas verde and vera2? I’ve seen a lot of frustration on the site and a lot of bugs listed and delayed response from the mcv team. Would you buy again or use homeward or another alternative? Mcv doing enough business to stick around?

2. Can one manage the lock codes remotely on the kwikset or schlage locks? I’d like to log in remotely, input a code for renters and then delete when they’ve left. It’s not clear this can be done onerous the Internet.

3. Are there other costs after the initial purchase? If I want SMS alerts vs. Email, do I need to pay more? I don’t see where additional service fees are listed anywhere.

4. Has any security review been done on the management website? Do the mcv guys know secure coding? I’ve seen so many instances of coders that have no clue and leave big gaping hole due to ignorance or a willingness to bear risk and not taking time to audit their security and allow XSS, SQL injection, etc. I don’t want some hacking my house locks due to insecurely managed cool solutions. The claims of “bank level security” SSL in the literature and videos mean little of the rest of the code sucks. Is ther a risk of a renter hacking the vera2 while they are visiting?

That said I look forward to a better solution than what I have today and am intrigued by what mcv has done with vera2. Thanks in advance.

[garrettwp]

[quote=“Abscam, post:1, topic:169130”]OK. I’ve been all over the wiki and this site and ready to pull the trigger but looking for some input. Thanks for your considered responses.

1. Are you satisfied with micas verde and vera2? I’ve seen a lot of frustration on the site and a lot of bugs listed and delayed response from the mcv team. Would you buy again or use homeward or another alternative? Mcv doing enough business to stick around?[/quote]

I have had my vera for over a year now and for the most part she has been running strong. Anywhere you go for a product you will most likely see more of people having issues or getting frustrated. So do not let the negative posts scare you. Most people on here are either asking questions or needing help. Vera is a great product. Once you get to know how to work it and it’s limitations, the product should work great and give you no problems. I choose MCV and Vera as it was affordable, it has 3rd party api support and I was not attached to any stupid monthly fee. MCV is more of an OEM as they do a lot of work for other companies. I do not think MCV will go anywhere any time soon.

@Abscam

2. Can one manage the lock codes remotely on the kwikset or schlage locks? I’d like to log in remotely, input a code for renters and then delete when they’ve left. It’s not clear this can be done onerous the Internet.

Yes, you can log into Vera via either MCV’s control panel @ cp.mios.com or you can use other forms of remote access (ssh, vpn, etc) to gain access to Vera’s web interface and issue new pins to the locks.

@Abscam

3. Are there other costs after the initial purchase? If I want SMS alerts vs. Email, do I need to pay more? I don’t see where additional service fees are listed anywhere.

There are no additional costs to use Vera. MCV has provided remote access for free. I do believe there is a limit to how many sms texts can be sent per day. But all in all there are no monthly fees.

@Abscam

4. Has any security review been done on the management website? Do the mcv guys know secure coding? I’ve seen so many instances of coders that have no clue and leave big gaping hole due to ignorance or a willingness to bear risk and not taking time to audit their security and allow XSS, SQL injection, etc. I don’t want some hacking my house locks due to insecurely managed cool solutions. The claims of “bank level security” SSL in the literature and videos mean little of the rest of the code sucks. Is ther a risk of a renter hacking the vera2 while they are visiting?

The way MCV provides security for Vera via remote access is pretty straight forward and secure. As any rule of thumb, always use strong passwords and when choosing a username for cp.mios.com, use something other than your name, or things that can be relate to you from the web. For using this product in a rental, I would strongly suggest that you keep the vera unit locked up somewhere. If you provide any sort of internet access for your renters, I would also suggest to have a separate network (guess network) that can not have access to the network that vera resides on.

• Garrett

[futzle]

@Abscam

4. Has any security review been done on the management website? Do the mcv guys know secure coding? I’ve seen so many instances of coders that have no clue and leave big gaping hole due to ignorance or a willingness to bear risk and not taking time to audit their security and allow XSS, SQL injection, etc. I don’t want some hacking my house locks due to insecurely managed cool solutions. The claims of “bank level security” SSL in the literature and videos mean little of the rest of the code sucks. Is ther a risk of a renter hacking the vera2 while they are visiting?

In short, I don’t trust MCV. That probably says more about me than it does about them.

Leaving aside the issue of LAN security (there is none), I’m just not in the habit of running SSH tunnels from inside my LAN out to a third party I haven’t personally been able to audit. Especially when that SSH tunnel key is the same on every single Vera MCV has sold.

If you’re worried about specific attacks on the MCV gateway, I haven’t been able to imagine any, and I’m pretty imaginative. I think the architecture is sound, but I can’t speak for the implementation. It would probably be rude for me to do a little Bobby Tables attack uninvited. Though I do find it interesting that your MiOS password has to be alphanumeric. To me, that always smacks of It Was Too Hard To Deal With Escaping Special Characters, So We Forbade Them.

Whether MCV support staff is open to social engineering, well, everyone is to some extent.

MCV staff are on record as suggesting that Vera customers are too insignificant to hack. That’s all well and good when you’re a niche player, but it’s not good to see that attitude in a company that has ambitions of being a major home automation provider.

That said, I still use their product. I just take precautions.

[Abscam]

Thanks for the comments folks.

[HouseBot]

1. Are you satisfied with micas verde and vera2? I've seen a lot of frustration on the site and a lot of bugs listed and delayed response from the mcv team. Would you buy again or use homeward or another alternative? Mcv doing enough business to stick around?

Im satisified. Had only had Vera2 for few month. It's not only point and click all the time but as you see the Forum members are really helpfull and the support also answers promtly if needed. Vera does all that I can think of and even more. There is 500 z-way devices on the market to be controlled. I have not been affected by any of the bugs mentioned so far.

3. Are there other costs after the initial purchase? If I want SMS alerts vs. Email, do I need to pay more? I don't see where additional service fees are listed anywhere.

No, you can receive one free sms and 20 emails per day.

4. Has any security review been done on the management website? Do the mcv guys know secure coding? I've seen so many instances of coders that have no clue and leave big gaping hole due to ignorance or a willingness to bear risk and not taking time to audit their security and allow XSS, SQL injection, etc. I don't want some hacking my house locks due to insecurely managed cool solutions. The claims of "bank level security" SSL in the literature and videos mean little of the rest of the code sucks. Is ther a risk of a renter hacking the vera2 while they are visiting?

The service was under a Denial of Service attack and they managed to solve that issue out after some time and after that I have not seen any more issue and I think MCV learned to be more communcative after this issue.