WetterCube/Sicherheit und Datenschutz/en
Dies ist die englische Fassung. Zur deutschen Fassung
The WetterCube runs in your home network, without an account and without a cloud. This page shows how it protects itself, what you should do yourself and which connections it makes to the outside.
Protection in the home network
- Host and origin check: Requests to the web interface must go to the IP address or the name of the device (
wettercube.local). Writing requests from a browser are only accepted from the device's own page, and starting an update (/update/install) also only works from the device's own page. This stops a foreign website in the browser of some device on your home network from changing settings or starting an update. - The setup Wi-Fi "WetterCube-Setup" is open (no password) during the first setup. It is only switched on briefly, until the device knows your Wi-Fi. Best set up the WetterCube at home when no strangers are within range.
- Password for the web interface (optional): At the bottom of the settings page you can set a password (at least 6 characters, user name admin). The device then asks for it when the page is opened. After eight wrong logins access is blocked for a minute. Forgot it? On the login page "Passwort vergessen?" (forgot password) leads on: a six-digit code (valid for two minutes) appears on the display of the device, which you enter in the browser. The password is then deleted. After five wrong codes resetting is blocked for ten minutes. This only works if you have the device in front of you.
What you should do yourself
- The device belongs in your normal home network, not in a guest Wi-Fi, and must never be made reachable from the internet through port forwarding.
- Keep the firmware up to date (see Updates (OTA)). Note that the WetterCube only gets security updates when they are necessary.
Limits you should know
- The web interface uses HTTP, not HTTPS. Without a password anyone on the same network can operate it. The password also travels unencrypted over your home network: it protects against access from other devices and foreign websites, not against someone who reads the network traffic.
- The Wi-Fi password is stored unencrypted in the device's memory. Anyone who holds the device physically can read it.
- Firmware updates come over HTTPS with a verified certificate from GitHub, but still without a signature of their own.
Which connections does the device make?
The device sends nothing to the developer: no account, no statistics, no ads.
| Service | Purpose | What is transmitted | When |
|---|---|---|---|
Open-Meteo (api.open-meteo.com, air-quality-api.open-meteo.com, geocoding-api.open-meteo.com) |
weather, forecast, air quality, pollen, place search | the coordinates of your location (the name when searching a place), plus the IP address of your connection | regularly |
GitHub (jppeterson-lab.github.io) |
update check and download | the IP address | on request under /update
|
Time server (europe.pool.ntp.org) |
time of day | the IP address | at start and occasionally afterwards |
More notes on liability and use: usage notes. Please report security problems confidentially as described in SECURITY.md.