Dynamic pin code and setup IDs.

[schinckel]

Reading through the Apple HAP documentation, it's pretty clear that "if a device can dynamically generate pin codes, it should."

To that end, I started playing around with stuff, and a dynamically generated pin code has no drawbacks (other than having to see what value was generated this time around).

I believe the same is true of setup id (which is used for the URL generation in #31 and #30). To that end, I believe that these values should not be stored in the pickle.

The other thing I discovered while developing accessories is that pickle is not a great way of storing stuff, especially during development. It means that if you change a class, or an import, then things can stop working, and you'd need to delete the pickle file and then re-add the accessory. There are also possible security implications of pickling data, but I'm less concerned about that because we aren't unpickling user supplied data.

[schinckel]

Hahaha! Just saw the commit f739316

[ikalchev]

Hi Matthew,

Thanks for sharing this info. Some thoughts:

I think it's nice to have dynamically generated pins and IDs. However, I do think these should be stored as part of the accessory state for the following reasons:

• Wasn't the setup ID included in the mDNS advertising?
• I am not entirely sure why, but the pincode can be sent by HAP clients in a HTTP authorisation header, for which there is a TODO in the hap sever. This is also the case in HAP-nodejs. So eventually, this todo will be done and the same pincode (that was presented during the pairing) needs to be available.

Thoughts on the above?

But yeah we should definitely add this - if you want you can work on it, otherwise I will when I find the time.

Best,
Ivan

PS: The pickle was very annoying indeed, sorry about that - I regret being lazy and not doing it properly from day 1.

[schinckel]

Yeah, the setupID (or a hash based upon it) is indeed included in the mDNS advertising, but when you restart the service, you re-advertise.

The other part (the auth stuff) I'm not sure about. I'll see if I can find a reference to it in the Apple docs.

[ikalchev]

You advertise all the time, but you need the same setup ID every time, correct? (otherwise iOS won't recognise you?)

[schinckel]

You need the same username (the mac), but the setup_id can differ.

[schinckel]

(I've tried, you can configure, then restart with a new setup_id/pincode and it all works fine).

[ikalchev]

Great, so setup ID won't be persisted. Only pincode (due to the HTTP auth header thingy).

[jslay88]

setup id and pincode can be unique each time, correct. (for basic HAP stuff)

[ikalchev]

Big thanks @schinckel for contributing. Will add the pincode persistence myself if I do the TODO.