Previously on my smarthome adventures, I kitted my house out with LIFX Bulbs and some WisQo Switches. I've moved home and none of my bulbs are compatible with the existing sockets!

What else am I going to do except BUY MORE LIGHTBULBS!

As much as I enjoy LIFX, they're bloody expensive. A single GU10 bulb is FIFTY QUID! Our new kitchen has 17 bulbs. Even if bought in bulk, that would cost me £765. Forget that noise!

So, I've gone with the Philips Hue system. The hub was just under £50 on Amazon. The bulbs use Zigbee rather than WiFi - which makes them cheaper and more energy efficient.

But Hue's GU10 bulbs cost about £20 each - that's still quite expensive.

Luckily, Zigbee is an open protocol, and there are loads of manufacturers of compatible bulbs. I found a fourpack of Zigbee GU10 for £40 - a tenner per bulb. A fifth of the price of LIFX. Would they work together? Yup. I don't have anything to rant about. I configured the hub, installed the app, plugged in the bulbs, and - boom! - they were instantly discovered and started working.

There are three very minor niggles.

1. Amazon Alexa went absolutely bananas. Discovering all those bulbs at once prompted her to keep saying "I have discovered a new light bulb. You can use it by saying..." Imagine that close to 20 times.
2. The Innr bulbs don't support firmware updates unless you have the Innr hub. That's probably not a huge problem. Their website says: "so far it has never been necessary to do a firmware update. All Innr lamps have the latest firmware approved and certified by Zigbee Alliance." I guess I'll buy and return a hub if necessary.
3. The dimming curve is slightly uneven. Using the Hue app's manual control, I can fade the lights out gently. When I turn them off, they dim quickly to about 25% brightness and then shut off. Bit weird, but not a dealbreaker.

If you can recommend a cheap supplier of Zigbee lights - or any other Zigbee gadgets - please let me know.

This is yet another complaint about solipsistic app design.

Let's take my Lifx bulbs. I have a friend staying for a few days, and he needs to be able to turn lights on and off. Lifx make this functionally impossible. The available options are...

• Give my full email address & password to him. This feels suboptimal.
• Allow him on to my main WiFi. Again, suboptimal. This is why my ISP provided router has a guest mode.

Bleugh. Neither is a good solution. Luckily I have an Amazon Alexa hooked up to the lights. But because Alexa's "AI" is barely above the level of a speak-n-spell, that's also unsatisfactory.

My guest tried to turn off the hall lights. Only he used the wrong invocation. "Alexa, turn off the landing light" just doesn't cut it. Such AI, much recognition, big data mood.

In a fit of pique, he asked Alexa what devices it had attached. The response was typical of Alexa's usefulness: What a load of bollocks!

There's an obvious solution to this. Guest accounts.

I know it is a cliche - but Silicon Valley geeks who are too anti-social to have friends and family is a right pain in the arse for everyone else.

Note to commenters

If your solution is "just buy this new bit of kit" or "configure this half-finished library from GitHub" - then you are part of the problem.

Here's a demo - fair warning, my vocal prowess is "limited".

OK, here's how to do this.

• I recently got a bunch of Lfix bulbs as part of a bug bounty.
• There's a full API for the Lifx bulbs.
• My mate Ruth has written a great demo on the Chome Web Speech API
• So, speech + Lifx = awesome.

This was a 5 minute hack, so my code is quite shameful, but here are the basics.

Firstly, we need an HTML page with JavaScript to detect the speech. At the moment, this only seems to work in Chrome (AKA the IE6 of 2016).

var red  = ["red", "read","ret"];
var yellow  = ["yellow", "yell", "yeah"];

// new instance of speech recognition
var recognition = new webkitSpeechRecognition();
recognition.lang = "en-GB";

// set params
recognition.continuous = true;
recognition.interimResults = true;
recognition.start();

recognition.onresult = function(event){

  // delve into words detected results & get the latest
  // total results detected
  var resultsLength = event.results.length -1 ;
  // get length of latest results
  var ArrayLength = event.results[resultsLength].length -1;
  // get last word detected
  var saidWord = event.results[resultsLength][ArrayLength].transcript;
  saidWord = saidWord.trim();

  console.log(saidWord);
  xmlhttp=new XMLHttpRequest();

  if (red.indexOf(saidWord) >= 0)
  {
      console.log("sending red!");

      xmlhttp.open("GET","lifx.php?colour=red",true);
      xmlhttp.send();
  }

  if (yellow.indexOf(saidWord) >= 0)
  {
      console.log("sending yellow!");

      xmlhttp.open("GET","lifx.php?colour=yellow",true);
      xmlhttp.send();
  }

If it detects one of our magic words, it sends it to a server component. I just don't trust JavaScript with my API keys. The server page is a simple PHP script.

$link = "https://api.lifx.com/v1/lights/all/state";
$authToken = "";
$colour = htmlspecialchars($_GET["colour"]);
$data = array("color" => $colour, "duration" => "0.5");
$ch = curl_init($link);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "PUT");
curl_setopt($ch, CURLOPT_POSTFIELDS,http_build_query($data));

$headers = array('Authorization: Bearer ' . $authToken);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

$response = curl_exec($ch);

Take the colour and send it to the bulb. Make the transition time fairly quick (half a second). The "Rainbow" command just sends random colours with a much shorter transition.

And... err... that's it! The Lifx API lets you send colours as strings, hex codes, HSB, etc, so it is fairly flexible.

Sure, I could have bought an Amazon Echo (not available in my country) or a Google Home (not launched, will be abandoned next year) or a Raspberry Pi (too easy to lose) or built an app for my phone (just too much hard work) - but I'm quite happy playing around in the browser.

Here's the video again, if you like watching things on Twitter.

Terence Eden is on Mastodon

@edent

My Lifx bulbs now react to my (*atrocious*) singing. Forgive me!

Source Code: github.com/edent/Harry-Po… pic.x.com/s8lxbjh9w7

---

If you enjoyed this blog post, buy yourself some Lifx bulbs or you could send me something from my wishlist.

One of the best things about them is their open API. Sure, you can use IFTTT if you want something easy - but us 1337 hax0rs want an API and Lifx provides it.

The API is pretty secure - good use of OAuth and tokens to make sure whatever you're building is resistant to infiltration. I mean, imagine if someone hacked your lightbulbs and ... err... switched off the light while you were reading. That'd be dreadful!

As I was wandering through the developer documentation, I noticed that there was a prominent login form. The pages were not served over HTTPS, and the form was similarly submitting to an insecure page. Typing in "https" before the URL showed a mismatched certificate error.

Not a great user experience - and a good way for customers to have their passwords intercepted.

24th April 2016

I took a quick note of my findings and used Lifx's contact form to alert them.

The URLs http://api.developer.lifx.com/ and http://lan.developer.lifx.com/ ask developers for their email address and password.

The site is NOT served over httpS. If a user tries to manually force it to https, they get a mismatched certificate error.

If a developer is on an insecure connection, this could cause their credentials to leak.

Can I strongly urge you to fix the certificates on the site and to reset the passwords of any user who has been affected.

27th April

I received this very positive note back from one of their engineers.

Thank you for reporting this issue to us. At LIFX we take our users and developers security extremely seriously. Here we clearly dropped the ball, and we need to be better.

Today I obtained certificates, sent them to our provider and set the documentation sites to enforce SSL. Finally I also changed most links to link to the SSL version of the site by default. We will be internally discussing how to best inform anyone affected.

Again thank you for your time finding and reporting this vulnerability to us. Your efforts have made us all more secure.

That's a pretty good response time for a company - especially given the timezone differences.

Conclusions

I checked, and the sites are now securely behind https.

It appears that the "log in" form is actually to log in to the ReadMe.IO documentation service. I would expect that most developers would see "Log In" and use their Lifx credentials. This means that ReadMe.IO (who I'm sure are honourable people) may inadvertently be receiving usernames and passwords for an entirely different service.

If you've previously clicked that Log In button, it would be sensible to reset your password and revoke and OAuth tokens you may have generated.

If you run a website, think hard about which login prompts you display - and whether tired developers are likely to make mistakes.

Bounty!

I obviously wasn't expecting a million dollar payout - but was pleasantly surprised to receive a clutch of new bulbs as a thank you gift. Anyway, here's me casting a spell on one of my bulbs.

Terence Eden is on Mastodon

@edent

That think where you have a kickarse idea only to find some beat you to it by FOUR DAYS! x.com/kelvzhan/statu…

Kelvin Zhang

@KelvZhan

First working implementation of voice controlled @LIFX lights using Python Jasper + lifx-cli @smarthall pic.x.com/lkfpjo7onz

---

---

Terence Eden is on Mastodon

@edent

Replying to @edentWoo! Using the WebKit Speech Recognition API I can now control my Lifx bulbs like Harry Potter :-) pic.x.com/ykphwepthy

---

Read more on my GitHub repo.