Decrypting Flume Water Monitor Traffic
Summary
The post documents how the Flume water monitor traffic can be decrypted due to a static secret key and non-TLS MQTT communication. It describes a MITM relay 'flumewatch' and the discovery that the bridge uses a fixed 32-byte key in flash with LibHydrogen secretbox; it discusses security implications and potential mitigations.