Solved, no issue: Official Hue integration - weird stuff going on, security issue, or?

I've been using Hue w/HE for two or three years now, now issues.

Started having a light coming on that I was trying to track down, and was referred to this Hue page by @DubbyDad (thanks again): https://account.meethue.com/

On that page I had a number of apps enabled, some old so I removed them, along w/some that I didn't recognize, so removed them as well. One of the oddest apps was this one. I removed it.

image

I noticed shortly after that none of my Hue bulbs were responding. I went to the HE Hue Integration and saw this message:
image

Pressed the button on the Hue bridge and my bulbs came back and things are working again from HE.

The odd part now is that this app that I had deleted from my Hue app list came back:
image

This second app I had deleted also returned, possibly related to requirements of the HE integration:
image

Would appreciate getting some feedback if this seems normal or should be interpreted as concering. The "7-0" name doesn't look right, and I'm coming up empty trying to link it to anything related to Hue/HE. Here's what's currently in my app list on the Hue site:


Time to panic/I've been hacked, or ?

Tagging @bertabcd1234 since he's very familiar w/Hue...

1 Like

It is; Hubitat generates a name like that (would be great to have "Hubitat" or something in front of it, but it is what it is; for CoCoHue, I prepend "Hubitat CoCoHue" to make it clear). The "7" should correspond to the app ID of your Hue Bridge integration.

4 Likes

Thanks VERY much for the quick reply...my fingertip was hovering over the "Remove app" link!

Agree - that should be clarified. At my old company we had issues due to similar unclear labels. Whom should be pinged on this from the HE side? Must be a pretty simple change, right? (As soon as you think that it becomes a breaking change...) :slight_smile:

Oh, and you are correct - app id matches up.

Theoretically, yes; in reality, no. :slight_smile: I used "Hubitat CoCoHue#" followed by the hub name, but then it turns out that certain characters aren't allowed in these descriptions, likely anything non-ASCII, and then people got errors when trying to connect the hub ... so, a number corresponding to the app ID is certainly a safe bet, and I don't blame anyone for going simple. (But maybe at least "Hubitat" in front would help.)

1 Like

Would, quite a lot. Would have kept me from shooting myself in the foot, wasting my time and MUCH more importantly/unfortunately, wasting your time . :wink:

As long as you're here (and I will pay the overtime)...is there a way for me to confirm what app/who this is from the Hue list? Want to remove it but don't want to break something else useful. Related to HE, or not, and if not is there a way to track it down?

image

That I don't know. When a third-party system requests access to Hue, it also submits a "description" that gets displayed here, but what they include there is totally up to that system, not Hue. Apparently, this author chose a GUID or something that looks a lot like one. I don't know what that would be except apparently not anything I'm using, as I can't find anything like that in my list...

1 Like

OK, thanks very much for looking. I may just delete it and see if something breaks. :slight_smile:

Tagging @bobbyD about the labeling issue. Bobby, any interest\chance this could get addressed? Using 7-0 as the HE app name is a tad confusing.:slight_smile:

Not sure how the name tag works, but we will look into it. It's not hard coded as "7-0". Mine for example is 40-0 lol. I guess we don't set a name, so Hue is setting one for us. In any case, I recommend getting Hue Essential app. It is a must have utility app to manage Hue bridge. Comes with an extensive logging system that can help you troubleshoot any problems, and has many features no longer available on Hue app, like changing Zigbee channel.

2 Likes

It looks like it's the app ID, certainly not hardcoded. I'm pretty sure this is a required parameter when you POST to the Hue Bridge /api endpoint to request a username, or at least it's in all Hue documentation like it is. Search the code for devicetype (the name of those parameter in the body) and see if anything comes up. :slight_smile: (If not, I suppose its possible Hue takes something from the URL it's called from and this is what we get?)

1 Like

The Hue app has always and still has this setting , altough be it obscured.

If you go to settings (cogwheel) scroll down to bridge settings (2nd cogwheel), click the pen upper right hand side, close the dialogue box that lets you change the name of the bridge and then click zigbee channel, a red bordered button at the bottom of the screen (change channel) let’s you do this.

2 Likes

LOL...they certainly did bury that near the bottom of the rabbit hole. On the other hand, most customers would stub their toes mucking w/the channel trying to fix something that wasn't broken. :slight_smile:

Yeah, sorry, @bobbyD - I didn't mean to say that 7-0 was the name everyone would get. As @bertabcd1234 noted, the name appears to be taking the app ID from each user (mine is 7, I'm guessing your app ID for Hue integration app is 40?).

Thanks for the tip on the Hue Essential app, I'll look into that.

2 Likes

I dare you to click "change channel" to see what happens. HINT >> install Hue Essentials before you do it!

3 Likes

Already did that before the remark :innocent::ok_hand: never waste good information.

EDIT; it took me 4 pushes to get back to the channel i was on. Sinew are both right, the channel can be changed, it’s just a random channel change the Hue app does (scrolled through 11, 15, 25 and then back to 20 where it was). Obviously the advantage of HUE Essentials you can just pick it manually.

Besides that essentials offers a lot more as you already pointed out @bobbyD :sunglasses::pray:.

But I’m sticking to my remark that the standard hue app CAN change the zigbee channel of the bridge :rofl::stuck_out_tongue_winking_eye:

Right, Hue app used to let you pick the channel too, but they removed the option to select desired channel a while ago. For folks running multiple Zigbee networks, is critical to be able to select the channel to reduce interference.

1 Like

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.