Actually, it looks like Vera is sending data to ERGY in clear-text. That includes Data and the ERGY Key. Probably not the best to take private data and let everyone see it.
Florin,
It also ships, in cleartext, descriptions of a number of non-power management devices over to ERGY.
ie. I saw the device descriptions for my SQBlaster, my Alarm System components (Motion Sensors etc)
Why is this plugin permitted to send soo much of my data to a third party? I don’t believe I ever signed up to let it know anything other than Power data
I’ve removed the plugin since it’s leaking WAY too much data to a third party to be considered trusted.
Has the MCV Team reviewed the code of this Plugin, and validated what it’s doing against any contract you have in place with them?
[quote=“garrettwp, post:3, topic:171865”]This is a huge security concern and MCV should be in contact with ERGY to rectify the situation!
Garrett[/quote]
Yeap, glad I ran it on a test system first. All plugins have access to the Network your Device is sitting on, so they run with a high level of trust on behalf of the users.
To me, they’ve violated that trust by ignoring very basic Security-principals (least data-exposure, protect data in-flight).
I won’t be installing it again, and I’d recommend others also steer clear - at least until there’s been an appropriate disclosure of the data being copied to their servers, and rudimentary protections/controls for data in-flight. If they publish the client’s source-code, for example, then it could be vetted for these things (both now, and over time)
The ERGY paid service is hosted, so they’ll keep their secret sauce and continue to make money. There should be no reason not to publish [logically or physically] what the client-code is doing/collecting to allay concerns and get a rudimentary security stance in place.
… come to think of it, how is the data protected at-rest when it’s on their infrastructure?
… and has anyone done an overall security audit of their efforts?
[ul][li]Protection on data in flight
[/li][li]Protection on data at rest
[/li][li]Minimal data sent, based upon absolute need
[/li][li]Disclosures on what is transmitted/collected/stored
[/li][li]Mechanism to purge
[/li][list][/list][/ul]
Ergy runs an occasional simple poll of the entire device list in order to account for the device list updates and changes. This is computed server side in order to keep the Ergy code light. The only information that it’s sent for devices that do not report energy is the device name, number and category.
Where did you find that? AFAIK EchoLabs is not related to MiOS or Mi Casa Verde.
Yep, shows how good my memory is. It is ergy and tricktv that appear the same. I thought that was quite curious, as tricktv has the same tech support ssh tunnel system as MCV through tsx.mios.com
It’s trivial to build the list of wattage based devices, at startup, and only transmit that. There is absolutely no need to transmit anything else.
It’ll be a tiny amount of Lua code, a much smaller on-the-wire representation, and less SSL overhead overall.
My Vera2 has well over 100 devices, and less than 14 energy ones (2x Brultech ECM-1240’s). A more typical setup is only going to have 1 or 2 power meeting devices, so why transmit all that unneeded data (regularly)?
BTW: even with everything being transmitted, they still don’t use the standard power metering service, so they still cannot see the Brultech (presumably also the CC and TED) plugin devices…
Best Home Automation shopping experience. Shop at Ezlo!