> If the device was validating the server certificate, it wouldn’t make it this far, so that shows that our certificate was accepted.<p>One more very good reason for preventing requests to "the cloud".<p>However, I find it funny that the lack of proper certificate validation (which is a security issue in principle) is a pre-requisite for the "de-cloudification" process.
IoT devices should come with at least a QR code to the documentation for the API, to be able to write our own backends. In that way they would sell the hardware, not the data of the people that installed those devices at home.
There's another thing not mentioned.
From the payload it looks like one may be able to spoof other customers' sensors by altering the serial (maybe it's a contiguous number) and replay the request. Heck, it is just one "curl -X PUT -d ..." command away, the info is all in the article