Excellent recommendation 
Will reconfigure the RMās right away.
1 Like
You can also just configure a open wifi directly in your case as with the double layer snake oil 
your network access is unbreakable for most anyway!
I believe there are other attack vectors within a home network more worth the effort for potential intruders in case someone really intends to break in into a WiFi network than looking for some WPA2 protected Broadlinks.
It is clear that you prefer ESPHome wherever you can which is fine.
Nevertheless it seems simply too far-fetched to talk down Broadlink IR-Blasters per se just because they are using WPA2 algorithms.
But then again, to each his own 
1 Like
WPA2 can be sufficient if PMF is enabled. 
If not (because it is not supported or wanted) it is enough for a bad actor to just de-auth your wifi client (like a broadlink device) and capture the handshake when it reconnects. A device which can does this is a $5 esp32 for example. The cracking of the handshake can then be conveniently done in the clouds 
But then again, if you have nothing to hide you can just use an open/unencrypted wifi
I am not opposing the fact that WPA2 authentication can be cracked. That is all too well known.
What I donāt see is why some bad actor would want to bother to sniff out some Joe Averageās hidden SSID for IoT devices? Besides of no MAC-address is allowed to connect to that network other than the known.
Thus as for the time being I see no urge to throw all RMās away just to jump on the ESPHome train.
Thatās simply a superfluous statement.
Whatās all the FUD about? 
It might be a bright and sunny day but you donāt see it 
The average joeās hidden wifi with mac positive list is nothing but snake oil. Both are not measures to secure a network. Decloaking hidden wifi or mac spoofing is nothing new. Joe certainly put his faith in the wrong peopleā¦ 
But again, what you (or joe) does with his private network is up to him. 
The problem starts when suggesting to use broken/weak/obsolete WEP/WPA/WPA2(without PMF) and further more making false claims that their weaknesses could be mitigated by hiding a ssid or limit access by mac. 
No FUD, just facts 
There is no way a device can connect using MAC spoofing unless it has physical access to the network or knows the address in advance. Even in the link you quoted it is explicitly mentioned āā¦ in MAC address spoofing the response is usually received by the spoofing party if MAC filtering is not turned on making the spoofer able to impersonate a new deviceā.
3 Likes
If you make use of WPA2 without protected management frames (801.11w) all devices permanently broadcast their MACs in plain text. That means the mac address is known in advance and physical access is not necessary. 
For the same reason (plaintext management frames) deauth attacks are possible 
[ā¦] even when the session was established with Wired Equivalent Privacy (WEP), WPA or WPA2 for data privacy, and the attacker only needs to know the victimās MAC address, which is available in the clear through wireless network sniffing.
to round 
it all up 
But WEP, WPA or WPA2 (without 801.11w) is not the way to go in 2024!
The weakest link in your network is always the weakest device! It can be that you put all the snake oil 
techniques in place people with little expertise ramble about (mac positive list and what not) but still this all doesnāt mitigate the severe downgrade you do when not using WPA3 (or WPA2 with 801.11w) 
In the end you might have 99 devices that support 801.11w and one broadlink device that isnāt capable. Depending on your AP you might need to downgrade all 100 devices to make use of WPA2 without PMF which greatly exposes your wireless communication and allows denial-of-service attacks that canāt be proper mitigated 
A little bit like groundhog dayā¦ over 20 years ago I had people that just continued using their WEP only capable devices (like a roku internet radio)ā¦ not for to long as their network was compromised quickly. 
Still you find āexpertsā that will still suggest to try WEP so you get your hardware with super sh*tty software support running - maybeā¦ 
Thereās at least one report that changing to WEP made the SSID show up on the Roku.
@Tamsy I would highly suggest you talking to a professional for a second opinion. You probably will hear what you donāt want to hearā¦ 
But instead of dumping your broadlink device right away (and upgrade your wifi to make use of 801.11w) you could also might just invest $2 and put a esp32-c3 (supermini) inside so the device can continue to do itās thing for another decade or two in a safe way. Beside you extend functionalities of your device as it also can handle bluetooth this way and work as a proxy for HA as an example
Wow this thread has derailed quite a bit.
Anywaysā¦
Brand: none
Model: ESP8285 based
Link to exact product: https://de.aliexpress.com/item/1005005777409596.html
Protocol: WIFI
HA Integration: ESP -Home
In use since: 2022?
Number of this item in use: 1
Positive:
- Easy to flash
- Local
- You can add more things to it
- DIY
- Dirt cheap
- Very small
Negative:
- DIY
- No case
My rating (1-5, 1 being bad, 5 being super): 4.5
Comment: you can solder other components to the board, itās not easy but itās doable.
The LED can be desoldered and extended using cables.
4 Likes
Well, I am a professional working as a system integrator and system administrator for over 30 years now and I am surrounded by IT pros in a data center nearly every single working day
Nevertheless I regard using WPA2 authenticating devices until their ānatural deathāsā (caused by hardware failure) still feasible at this time and I am convinced the risk of my RMās are getting de-authenticated within a guarded housing estate neglectable. Maybe I have to point out that I am not talking about WEP here.
BTW, I have quite a few ESPHome based devices including bluetooth-proxies in place already since I have started this HA-journey.
Hey orange. I realize this post is getting a bit old but I was hoping you could do me a favorā¦ can you find a current link to this product? Or just an image to show me which to look for?
Might want to add the (valuable) findings from this thread to your device listing? 
Protocol: Wi-fi (limited to WPA2 without PMF/801.11w, pre-shared key limited to 30ish characters)
Negative:
- No 801.11w (protected management frames) support present
I tried but didnāt find the exact device I haveā¦ still it is essentially enough to have any device thatās supported by esphome ā¦ so like a esp82xx, esp32, beken on realtek chipsā¦ 
For example (esp8266 based): 
Thanks. I mostly just want to avoid having to swap a module. I have some extra esp32-c2 superminis that I believe would fit, but I have less time to play with than I did 5-10 years ago. I ordered this https://a.aliexpress.com/_mrXCjUG and will report back for anyone interested what my experience is like. Thanks again for the reply.
For anyone interestedā¦ I received this device in the mail yesterday, played around with it (until way too late) last night, and it seems to be doing everything I want it to do. The item I linked is IR only so it does not have 315/443. Ignore the wires other than brown, white, and black. Those are connected to clearly marked (on the board, not in my pic) pads for rx/tx/gnd.
This page is about the exact board that I linked.
This page has this pinout. I thought it was odd that the button on pin 9 was not mentioned since that is the easiest to determine, butā¦ button is pin9. For me there is no use case for it, but thatās where it is.
I backed up the stock image with ltchiptool, then used that same tool to flash a binary that can now be made directly in esphome gui.
Here is the esphome page for LibreTiny.
More info about the BK7231T/BK7231N here.
I used one of these cheap CH340 programmers from Amazon, connecting only rx/tx/gnd and powering with the on-board type C port of the board. Quick tip on thatā¦ if you are simple like me and connect rx to rx you might waste some time troubleshooting.
Thereās nothing fancy in my esphome yaml and there probably wonāt be because my only goal here is to not send data through the internet (possibly to the other side of the planet) and back just to turn on my AC. 
Formatting was annoying me on here, so I used pastebin.
2 Likes
Hey can you update the link of your product? I bought a rm3 mini and is very bad, losing WiFi every mins
Have you increased the bandwidth on the frequency you are using? I had similar problems with devices and increasing bandwidth from 20 to 40 MHz in the router fixed this.
Id like to do not touch my router settings. The device should work nonetheless,
If your broadlink rm3 mini works with your router/ap actually reveals that you have weak wifi security.
You should do that right away and activate protected management frames (PMF/801.11w - a 15 years old security feature ) 