Problem/Motivation
Noticed plaintext HTTP requests to http://hw.airgradient.com/sensors/airgradient:{serialnumber}/generic/os/firmware for firmware version from the Home Assistant plugin. Since #170.
These requests are leaking the unique MAC / serial of my unit(s) over the public internet, which is concerning as I do not want this sort of information easily monitored by whoever is listening - at least with HTTPS it would only be possible to tell that I probably have one or more units, not the specific count, and also not the specific unit identifier.
I haven't analysed the firmware on the unit itself to check whether it is sending any info to airgradient also over unencrypted HTTP, will check later and post an issue in the related repository if so, as that would be more concerning - all identifying communication should be over HTTPS these days.
Expected behavior
Unique hardware identifier not leaked in plaintext HTTP during firmware update check.
Actual behavior
MAC address / serial number leaked.
Steps to reproduce
Observe packet capture of Home Assistant instance with AirGradient device added in Wireshark, look for plaintext HTTP (port 80) connections.
Relevant line specifying HTTP URL and adding serial
Proposed changes
- Replace self signed certificate on
hw.airgradient.com server with lets encrypt signed certificate.
- Request firmware update version over HTTPS instead of HTTP.
- If serial number isn't required to report the latest unified firmware version, perhaps don't add it - the endpoint seems to respond with the same version if I omit the serial...
Problem/Motivation
Noticed plaintext HTTP requests to
http://hw.airgradient.com/sensors/airgradient:{serialnumber}/generic/os/firmwarefor firmware version from the Home Assistant plugin. Since #170.These requests are leaking the unique MAC / serial of my unit(s) over the public internet, which is concerning as I do not want this sort of information easily monitored by whoever is listening - at least with HTTPS it would only be possible to tell that I probably have one or more units, not the specific count, and also not the specific unit identifier.
I haven't analysed the firmware on the unit itself to check whether it is sending any info to airgradient also over unencrypted HTTP, will check later and post an issue in the related repository if so, as that would be more concerning - all identifying communication should be over HTTPS these days.
Expected behavior
Unique hardware identifier not leaked in plaintext HTTP during firmware update check.
Actual behavior
MAC address / serial number leaked.
Steps to reproduce
Observe packet capture of Home Assistant instance with AirGradient device added in Wireshark, look for plaintext HTTP (port 80) connections.
Relevant line specifying HTTP URL and adding serial
Proposed changes
hw.airgradient.comserver with lets encrypt signed certificate.