Security and privacy

This page covers two things: what this website counts, and what the plugin keeps on your Homebridge machine. It describes what the software does. Read it as a description of where your data goes, not as a list of promises.

This site

This website counts page views with Umami. Umami is an analytics tool, a program that counts visits to a website. It is not a service from an analytics company: the plugin’s author runs it, at t.trao.dev.

• No cookies. The site stores nothing in your browser to recognise you, so there is no cookie banner.
• Do Not Track is respected. If your browser sends Do Not Track, the site does not count your visit.
• Only this site. It counts only on homeconnect-local.trao.dev. A copy of the site anywhere else counts nothing.
• No other outside requests. The site loads no web fonts and no scripts from other servers. Search runs in your browser.
• Blocking it is fine. If you block t.trao.dev, for example with an ad blocker, the site works exactly the same.

According to Umami’s documentation, it records for each page view:

• the page you visited and its title
• the page that sent you here, if any
• your browser, operating system and kind of device, such as laptop or phone
• your screen size and language
• your approximate location (country, region and city), worked out from your IP address

Umami does not store your IP address in what it records. To group the pages of one visit, it makes an anonymous code from your IP address, your browser’s description and a secret value. Umami changes that value every month by default.

The plugin

• No telemetry. The plugin does not report anything about you or your appliances to anyone. Telemetry means usage data a program sends home to its makers.
• No cloud after import. After you import a profile, the plugin makes no request to any server of BSH, the company behind Bosch, Siemens and Home Connect. The one cloud step happens in the download tool, on your computer, in Step 2.
• No Home Connect login. The plugin has no login and stores no Home Connect password or token.
• Local connections only. The plugin connects to your appliances on port 443 or port 80, and uses UDP port 5353 to look for them with mDNS. It does not wait for any other incoming connection.
• Only IP addresses. A hostname you type in Host is turned into an IPv4 address first. The plugin refuses to connect to anything that is not an IP address, so a changed or tampered saved address cannot point it at a website.
• Keys stay out of the log. Before the plugin writes something to the log, it replaces any field named key, iv or psk with [redacted]. That filter is a second line of defence: no log line in the plugin is handed anything that can hold a key in the first place. Messages that Homebridge itself writes, such as an error while loading the plugin, do not pass through this filter.
• The settings page never sends a key back. During import your browser reads the zip and sends it to Homebridge. After that, the settings page receives appliance IDs, brands, model codes, addresses and connection status. It never receives a key, an IV, a MAC address or a serial number. If the address of your Homebridge UI starts with http:// rather than https://, the zip is not encrypted on its way. It travels only across your home network, from your browser to Homebridge.
• A fake appliance learns nothing. Someone on your network could pretend to be your appliance. Without the appliance’s key, it cannot complete the connection, so the plugin only sees a failed connection and gives away nothing. If that happens three times in a row, the log can say the key was rejected.
• AES is the weaker connection. Some appliances use AES on port 80 instead of TLS on port 443. The appliance decides this, not the plugin. With AES, someone who can intercept your network traffic could replay old messages and make the plugin show old values. They still cannot make up new values or find out the key.

What is stored, and where

Homebridge has a storage folder. It is the folder that holds Homebridge’s config.json. The plugin keeps everything in a folder called homeconnect-local inside it:

Where	What	Holds a key?
homeconnect-local/appliances/<appliance ID>.json	The appliance’s profile, including its key, and its IV if it uses AES. An IV is a second secret value that AES needs.	Yes
homeconnect-local/appliances/<appliance ID>_DeviceDescription.xml and _FeatureMapping.xml	The two files that describe the appliance’s features.	No
homeconnect-local/state.json	The address where each appliance was last reached, its connection status, and an ID the plugin uses for itself when it connects.	No
homeconnect-local/import/	The import folder from Step 3. A zip that failed to import stays here, renamed to end in .rejected.	A .rejected file does
config.json	Only the settings on the Reference page.	No

The keys are stored as plain text. They are not encrypted, because the password to decrypt them would have to sit on the same machine, which would add nothing.

Homebridge backups contain your keys. A backup from the Homebridge UI includes the whole storage folder. Every backup you made after you imported a profile holds your appliance keys. Keep those backups as safe as the keys themselves, and do not share them.

File permissions

On Linux and macOS, every file has permissions that say which users on the machine may open it. The plugin sets its folders so that only the user Homebridge runs as can open them, and does the same for its files. In technical terms, folders get mode 0700 and files get mode 0600. Each time it starts, it checks them again. If a permission has changed, it puts it back and writes a warning such as:

[Home Connect Local] repaired mode of <path> from 644 to 600

If something in the folder is not a plain file or folder, such as a shortcut to somewhere else, the plugin names it in a warning and leaves it alone.

These permissions only keep out other users of the same machine. They do not help in these cases:

• Other Homebridge plugins. They run as the same user as this plugin, so any plugin you install can read the keys.
• Homebridge runs as the administrator user (root) in a container. Anyone who gets into that container can read the keys.
• The storage folder lives on a NAS share or a shared folder. Anyone who can read that share from another computer can read the keys.

The last two depend on how you set up Homebridge, not on the plugin. Check who can read the storage folder, and which user Homebridge runs as.

What a key lets someone do

Someone who has a copy of an appliance’s profile, and can reach your home network, can control that appliance. They can change its temperature, turn modes such as Vacation Mode or Super Cool on and off, and see when its doors open.

For a fridge or freezer, the worst case is food that spoils. The key works only on your home network. It does not give access to your Home Connect account.

A key keeps working until you pair the appliance again or reset its network settings.

Rotating keys

Rotating a key means replacing it with a new one, so that any old copy stops working. Do this if you think someone else got a copy of a profile zip or a backup.

1. Give the appliance a new key. Pair it again in the Home Connect app, or reset its network settings and set it up again. The Home Connect app and your appliance’s manual explain how.
2. Download the appliance’s profile again, as in Step 2.
3. Import it, as in Step 3. The new profile replaces the old one.
4. Restart the plugin, as in Restart the plugin.
5. Delete the zip from your computer.

Blocking the appliances from the internet

Some people stop their appliances from reaching the internet at all, with a firewall rule on the router or a separate network for smart devices. This is a trade-off.

What you gain:

• The appliance’s own cloud connection can no longer be attacked, and it can no longer send data to the cloud.
• The plugin keeps working. The maintainer of the profile download tool has confirmed that local control works with the appliance offline. One user reported local control still working through a ten-minute cloud outage.

What you lose:

• Using the Home Connect app when you are away from home, and its notifications.
• Firmware updates and remote diagnostics for the appliance.
• Pairing. Pairing an appliance again needs the cloud, and so does downloading its profile again after a reset. You must be able to put the appliance back online for a while to do either.

What nobody knows: whether the appliances behave well with the cloud blocked for months or years. Nobody has tested it.

If you do block it, aim for a narrow rule rather than a total block: only the Homebridge machine may reach the appliances, on ports 80 and 443. A compromised device elsewhere on your network then cannot talk to your appliances, while the plugin still can.

Reporting a vulnerability

If you find a security problem in the plugin, report it privately through GitHub. Do not open a public issue.

1. Open the plugin’s GitHub repository.
2. Click the Security tab.
3. Click Advisories, then Report a vulnerability.

Describe what you found, which versions of the plugin and Node.js you use, and how to reproduce it. Never send a real key, IV, profile zip or appliance ID. Use made-up values instead. The security policy has the details.

How you know it worked

After you rotate a key:

• On the plugin’s settings page, Plugin status for the appliance says CONNECTED.
• The Home app shows the appliance’s tiles with values, not “No Response”.