I had some issues with a Fibaro smart plug (it suddenly stopped working and stated that had used over 80million kilowatts in total in a few weeks through a small halogen bulb it is switching ) and decided to unpair and repair it. During the unpair I found that it went âout of syncâ or something like it. When I pressed the button for the unpair procedure on my smart plug, the Homey app stated that it was another device and that THAT device had been removed.
So I went to the developer page and removed it manually from there. (healing etc. didnât help). The pairing process went okay, no problems there. What I do notice now that it doesnât show the âsecureâ flag anymore.
If I however look at the app and look at the âGeavanceerde Instellingenâ of the smart plug it states â1â. All of my other devices (including another smart plug of the same type) have âmanager.vdevice.drivers.zwavebasic.devicesettings.yes_trueâ. This is the only device I have added since the 2.0 upgrade
Can anyone confirm:
Is my device secure/encrypted? (which is the only thing I really care about - The â1â suggests it is.)
Is this a bug in the 2.0 firmware/app (that it shows up as something different and the developer page doesnât handle that properly?
((also the âBatteryâ field says â0â on the repaired plug and on the other plug âmanager.vdevices.drivers.zwavebasic.devicesettings.yes_falseâ))
Thank you for your reply. So it IS actually insecure now. (even though the âBeveiligdâ field in âGeavanceerde Instellingenâ states it as â1â)
I only got a reply that the behaviour was a known bug and they were working on it. (It is resolved by now)
I had to re-pair (not as in âfixâ ) the device in order to get it to show as âsecureâ. I had no way of telling it was added as secure or not. (maybe it was possible via CLI, but I never tried that)
Talked to Telldus today. They told me that I shouldnât add any device as secured that isnât a lock, door, alarm etc. Sensors and wall plugs operates faster and better as not secure and the Z-wave protocol is crypted as it is.
In their hardware (controller) you can chose to add the devices as secure or not secure.
They did know about the Homey but couldnât say if or how to do the same thing in Homey.
Thatâs actually interesting information. Did they also mention what in their view âsecureâ means?
If you look at online sources, z-wave (as a protocol) is not encrypted âby defaultâ and the âsecureâ flag/command actually means/adds encryption (with the included data integrity and confidentiality, etc. etc.)
I am a Linux Engineer at an international financial organisation and from my professional point of view, all data transmission, regardless of function, purpose or method of transmission, must always be encrypted. In the case of z-wave, in regards to home or office automation, itâs actually a no-brainer.
Any data communication that is not encrypted, is trivial to listen in on and mimic them. This of course is extra important for wireless transmissions (since you donât need physical access to a cable).
At first glance you could think, well I donât care if my neighbour accidentality triggers my living room bulb. You can just switch it off again, and probably wonât think anything more on it. But by switching it off, a potential burglar knows someone is in the house, and that that person has switched off the light without being in line of sight of your house. A small raspberry pi with a battery unit just needs to be close by (under a pile of leaves in your yard for example).
If the data transmissions are encrypted, the burglar would only detect, that there is communication, and with z-wave being what it is (very chatty) itâs far more difficult to detect actual activity in the house.
This is just one small example of course, and, of course itâs far fetched, but there are numerous thinkable examples, like someone else falsely triggering your motion detector. The majority of thinkable examples can be mitigated by simply making sure everything is (strongly) encrypted.
No, they did not and I did not ask because I donât know for sure how it works.
Reading on z-wavealliance.org, I see that they say that communication is
Designed specifically for control and status apps, supports data rates of up to 100kbps, with AES128 encryption, IPV6, and multi-channel operation
As I said, I donât know about this things but isnât AES128-bit encryption pretty strong?
AES128 is indeed very decent for the purpose (not the fastest encryption cipher, but strong, robust and fairly easy to implement for hardware manufacturers, which generally means higher quality encryption). But it says 'supports data ratesâblablabla. The fact it supports it, doesnât mean itâs enforced (by default) or even properly used by all parties.
(For example: In the past z-wave units always used a default key (0000000000) which does make it encrypted technically, but, as you can imagine also very easy to break )
At any rate:
If you are interested in cryptography/encryption (in general, not z-wave specific) there is a nice playlist on Youtube on the subject: https://www.youtube.com/playlist?list=PLB4D701646DAF0817 totally about 45-50 minutes I think. It shows how encryption works. Using metaphores with paint color mixing and still carrying the load. It starts with some very high level background/history (back up to the stone age and the Roman Empire) and in the end uses simplified math)
) and decided to unpair and repair it. During the unpair I found that it went âout of syncâ or something like it. When I pressed the button for the unpair procedure on my smart plug, the Homey app stated that it was another device and that THAT device had been removed.
