Attack vector details are a bit sketchy, but there's at the very least some concerns raised. Particularly surrounding that private key. However, I will say that I'm not at all surprised that the firmware isn't of the highest quality. I just picked up some LIFX bulbs a couple of months ago and have been hugely disappointed with the firmware.
The mobile apps are fine, but the firmware just seems incredibly... not smart.
For example if you enable a schedule to address your circadian rhythm, then turn the light off with a wall switch at one point in the schedule and turn it back at another time. The light makes zero attempt to adjust its brightness and colour it just stays at the old setting.
Sure it hasn't had power, but it's not that hard to grab the date/time via NTP. Ideally there'd be a tiny battery just keeping a clock ticking over.
The mobile apps are fine, but the firmware just seems incredibly... not smart.
For example if you enable a schedule to address your circadian rhythm, then turn the light off with a wall switch at one point in the schedule and turn it back at another time. The light makes zero attempt to adjust its brightness and colour it just stays at the old setting.
Sure it hasn't had power, but it's not that hard to grab the date/time via NTP. Ideally there'd be a tiny battery just keeping a clock ticking over.