Next/Sicherheit und Datenschutz/en
Dies ist die englische Fassung. Zur deutschen Fassung
The Next runs in your home network, without an account and without a cloud. This page shows how it protects itself, what you should do yourself and which connections it makes to the outside.
Protection in the home network
- Host and origin check: Requests to the web interface must go to the IP address or the name of the device (
wettercube-next.local). Writing requests from a browser are only accepted from the device's own page. This stops a foreign website in the browser of some device on your home network from changing settings or starting an update. - Setup Wi-Fi with a password: The Wi-Fi "WetterCube-Next-Setup" is encrypted (WPA2). The password (8 digits) is shown on the display and changes with every setup mode. Someone who is merely within range cannot read what you enter. (WPA2 requires at least 8 characters.)
- Password for the web interface (optional): At the bottom of the settings page you can set a password (at least 6 characters, user name admin). The device then asks for it when the page is opened. After eight wrong logins access is blocked for a minute. Forgot it? On the login page "Passwort vergessen?" (forgot password) leads on: a six-digit code (valid for two minutes) appears on the display of the device, which you enter in the browser. The password is then deleted. After five wrong codes resetting is blocked for ten minutes. This only works if you have the device in front of you.
What you should do yourself
- The device belongs in your normal home network, not in a guest Wi-Fi, and must never be made reachable from the internet through port forwarding.
- Keep the firmware up to date (see Updates).
Limits you should know
- The web interface uses HTTP, not HTTPS. Without a password anyone on the same network can operate it. The password also travels unencrypted over your home network: it protects against access from other devices and foreign websites, not against someone who reads the network traffic.
- The Wi-Fi password is stored unencrypted in the device's memory. Anyone who holds the device physically can read it.
- Firmware updates come over HTTPS with a verified certificate from GitHub, but still without a signature of their own.
Which connections does the device make?
The device sends nothing to the developer: no account, no statistics, no ads.
| Connection | Purpose | What is transmitted | When |
|---|---|---|---|
Your Fusion (in the home network, via /api/next) |
weather and sensor data | the request saying which pages are shown | every 30 seconds, local only |
GitHub (raw.githubusercontent.com, jppeterson-lab.github.io) |
update check and download | the IP address | on a button press; automatically only if you switch it on (default: off) |
Time servers (pool.ntp.org, time.cloudflare.com, time.google.com) |
time of day | the IP address | at start and occasionally afterwards |
The Next does not call any weather services itself; the data comes from your Fusion. More notes on liability and use: usage notes. Please report security problems confidentially as described in SECURITY.md.