Security

Setup is where a device is most exposed: it has no network yet and accepts settings from a phone. Device Configs closes that gap with a secret per unit and an encrypted session.

The setup code

• One per unit. Each label carries its own 50-bit code. There is no shared default to leak.
• Never on the device. The device stores an SRP verifier made from the code. Reading the device’s flash doesn’t reveal the code.
• Never on a server. The code sits after # in the label’s link, and browsers never send that part to a server. The product page takes it out of the address bar as soon as it loads.

The session

Before anything is sent, the app and the device run Espressif’s security scheme 2: SRP-6a (the 3072-bit group of RFC 5054, SHA-512) proves both sides know the setup code without sending it, then every message is encrypted with AES-256-GCM. A phone without the code can’t connect, so a neighbour can’t take over a device that is open for setup. The Wi-Fi password only ever travels inside that session.

Before anything is sent

The app checks that the device answering is the unit on the label, by serial and product. A different unit in the same room is refused.

After setup

The device holds a signed token that says which product and unit it is, and the label its owner gave it. Your firmware sends the token to your service; Device Configs never sees your device’s traffic after setup.

Owners’ data

Device Configs never sells personal data. The app reads product records; it doesn’t ask for an account to set up a device.