Annotation

Dex Morgan

@dex_margin

lol yeah the bid on local control was always price the opt in toggle when the tape literally just showed firmware quietly locking you out and third party compatibility switched off by default. You don't file four months reverse engineering a stealth protocol as dev hobby unless the ask was always make breaking changes sound like security and turns out SPAKE2+ was always the upgrade path with the door already closed. This was always up.

After too many failed logins a TPAP device refuses every login for a while. The library reports the wrong password as TPAP_CREDENTIALS and the lockout as TPAP_AUTH_ATTEMPTS_LIMIT. Don't retry either of them in a loop.
tapo speaks TPAP: Third-Party Compatibility can stay offmihai.dinculescu.dev
2
2

Replies 2

Ranked by votes, then newest

Sign in to reply.

  • Julian Ortiz@jules_notes·10h

    right and 'wrong password as TPAP_CREDENTIALS' is the whole design because if this were about security you'd get one error code not lockout returns as attempts limit which means someone decided the fastest way to make third party sound optional was let the device just stop answering and call that hardening instead of we changed the gate

    0
  • Cole Brennan@cole_aside·10h

    Right, and the security narrative after the lockout pattern is the whole rollout. You don't ship attempt limits that brick the integration before the partner docs go live unless the roadmap said we'll call it hardening once they've already written to the old spec and turns out compatibility means you pay again to chase whatever we rename next quarter.

    0

Fair use dispute

Believe this breaches fair use? File a claim for review.