Well, if that’s a vulnerability then every smart device would be insecure. I don’t know of any device without OTA, even for my own ESP8266 and ESP32 projects, I can OTA them via my VPS server.
Well, that’s a personal opinion then. I’d rather have ease of use and convenience. In my case, local control doesn’t add much either. When we had an internet outage recently, I quickly disabled WiFi on my phone to check for outages but when I wanted to reconnect, I couldn’t since the main network uses WPA3-Enterprise and Zyxel Nebula needs the server to authenticate clients using the username and password. So even if local control was possible, it wouldn’t have helped. But I understand most people just have a “regular” network on a regular router
Yes, but only when associating. If the client is already connected, it will stay connected. This probably has to do with how Nebula Cloud Authentication works. When I connect a device to my main network, I need to create a username and password for it on the Zyxel Nebula cloud portal. Then, I need to authorize it to use the network and then I can enter that username and password to connect.
I can also choose if the device requires 2FA, which I have on for only some devices (only devices that I don’t use/disconnect often). In case of 2FA, it will open a captive portal where I need to enter OTP from Google Authenticator. Probably, Nebula works in a fail-safe way: when there’s no internet, don’t authenticate any clients. Some systems have backup methods which use a cache, but appearantly Nebula doesn’t. I also have MAC authentication set up for my IoT network (and want to move to DPPSK soon for better protection, then you can use different WPA2-PSK passwords per device, but that requires a lot of time to reset all devices and get them to use the DPPSK instead of the currently set up password). I never checked if MAC authentication still works without internet, we luckily almost never have internet outages in my area.
Well, it doesn’t run on my local network, it runs on a Linux VPS on the cloud, but the VPS is managed by myself though.
