WetterCubePlus/Sicherheit und Datenschutz/en
Dies ist die englische Fassung. Zur deutschen Fassung
The WetterCubePlus runs in your home network, without an account and without a cloud. This page shows how it protects itself, what you should do yourself and which connections it makes to the outside.
Protection in the home network
- Host and origin check: Requests to the web interface must go to the IP address or the name of the device (
wettercubeplus.local). Writing requests from a browser are only accepted from the device's own page. This stops a foreign website in the browser of some device on your home network from changing settings or starting an update. - Setup Wi-Fi with a password: The Wi-Fi "WetterCubePlus-Setup" is encrypted (WPA2). The password (8 digits) is shown on the display and changes with every setup mode. Someone who is merely within range cannot read what you enter. (WPA2 requires at least 8 characters.)
- Password for the web interface (optional): At the bottom of the settings page you can set a password (at least 6 characters, user name admin). The device then asks for it when the page is opened. The read interface
/api/ampelfor the WetterAmpel stays open. After eight wrong logins access is blocked for a minute. Forgot it? On the login page "Passwort vergessen?" (forgot password) leads on: a six-digit code (valid for two minutes) appears on the display of the device, which you enter in the browser. The password is then deleted. After five wrong codes resetting is blocked for ten minutes. This only works if you have the device in front of you.
What you should do yourself
- The device belongs in your normal home network, not in a guest Wi-Fi, and must never be made reachable from the internet through port forwarding.
- Keep the firmware up to date (see Updates (OTA)).
Limits you should know
- The web interface uses HTTP, not HTTPS. Without a password anyone on the same network can operate it. The password also travels unencrypted over your home network: it protects against access from other devices and foreign websites, not against someone who reads the network traffic.
- The Wi-Fi password is stored unencrypted in the device's memory. Anyone who holds the device physically can read it.
- Firmware updates come over HTTPS with a verified certificate from GitHub, but still without a signature of their own.
- The automatic update check (every 6 hours) cannot be switched off on the WetterCubePlus.
Which connections does the device make?
The device sends nothing to the developer: no account, no statistics, no ads.
| Service | Purpose | What is transmitted | When |
|---|---|---|---|
Open-Meteo (api.open-meteo.com, air-quality-api.open-meteo.com, geocoding-api.open-meteo.com) |
weather, forecast, air quality, pollen, place search | the coordinates of your location (the name when searching a place), plus the IP address of your connection | regularly |
German Weather Service (opendata.dwd.de, maps.dwd.de) |
warnings, Biowetter, 3-day pollen, warning map and radar | the request with the chosen region, plus the IP address | regularly |
GitHub (raw.githubusercontent.com, jppeterson-lab.github.io) |
update check and download | the IP address | every 6 hours and when installing |
Time servers (pool.ntp.org, time.cloudflare.com, time.google.com) |
time of day | the IP address | at start and occasionally afterwards |
| WetterAmpel (your add-on device in the home network) | temperature traffic light | the values from /api/ampel |
only if set up, only local |
More notes on liability and use: usage notes. Please report security problems confidentially as described in SECURITY.md.