Remote Access

[DBMandrake]

Just don't mention the HGI80, eh?

Sure, but the original poster was worried about IP / Internet related breaches via the Evotouch controller...

Yes you can control the system via an HGI80 but you'd need to be within about 30 metres of the house, which is rather different than being anywhere in the world. It also doesn't give you IP connectivity to the controller since you're limited to what the Rameses protocol can do.

[paulockenden]

Yes, I know they are completely different attack vectors.

I was just gobsmacked when I realised how insecure the HGI80 is, compared to the rest of the system.

[filbert]

This is an old thread but I am new to Evohome and am interested in the security issues. My biggest concern so far is that the App makes name and address mandatory. Naturally, I gave a fictitious address as I don't see that the system has any need to know where I live (I did use a fairly local, but incorrect, postcode so that local weather info is accurate).

I'm not concerned about someone turning my heating on and off but I am concerned that the backend might be compromised and a villain could get access to the daily empty/occupied pattern for all the properties in the database, including mine. The alarming increase in such hacks makes me even more cautious.

Am I being too paranoid???

[bruce_miranda]

Same reason why you don't set your Sat Nav, Home to your actual Home.
I had written an article about being able to profile a house, listen in and monitor it using Amazon products and services. And now we've just handed them the keys.

[paulockenden]

Thing is, if you don't set your proper home address in Evohome then you won't get the Xmas present that Honeywell sends all users every year....

;-)

P.

[Rameses]

This is an old thread but I am new to Evohome and am interested in the security issues. My biggest concern so far is that the App makes name and address mandatory. Naturally, I gave a fictitious address as I don't see that the system has any need to know where I live (I did use a fairly local, but incorrect, postcode so that local weather info is accurate).

I'm not concerned about someone turning my heating on and off but I am concerned that the backend might be compromised and a villain could get access to the daily empty/occupied pattern for all the properties in the database, including mine. The alarming increase in such hacks makes me even more cautious.

Am I being too paranoid???

I am not allowed to go into exact details (some of which I am not privileged to). But I can say Honeywell provide security and systems for than just Homes and a lot of these systems reside on the same platforms. Businesses, emergency services, etc. The personal info we ask you to input is also for warranty and support reasons. Usage data is held anonymously and separate from user details.

[filbert]

Usage data is held anonymously and separate from user details.

Thanks for your input - one of the benefits of Evohome is the fact that Honeywell contributes to the forum. Definitely a plus.

However, I expect the MAC, etc, of my device are stored with my name and address and also with the anonymous data (otherwise, how could it manage the device) and that means it would be trivial for a villain to link the two together.

Unless the warranty, etc, info doesn't include device details? Clearly, security has been thought about a lot more than some IoT devices I have read about but I'm still cautious.

[DBMandrake]

Same reason why you don't set your Sat Nav, Home to your actual Home.
I had written an article about being able to profile a house, listen in and monitor it using Amazon products and services. And now we've just handed them the keys.

And how many other products, services and companies have your email address, phone number and street address these days ?

The battle is already lost on the privacy front I'm afraid. I'm no more afraid of Honeywell losing my street address than any one of the numerous companies that I've purchased goods for delivery online with over the years! I hate to think how many companies still have my delivery address on their databases...

At least Honeywell's portal has never had my credit card numbers...