SmartTiles (& "other" External Services) Security

[geko]

Continuing discussion from:

Https://graph.api.smarthings.com Failed to load devices

It has nothing to do with “external services”. A SmartApp can disarm the Smart Home Monitor with a single line of code or push its armed/disarmed status to a rogue server. I can think of dozens of both explicit and covert abuse scenarios a malicious SmartApp could do. SmartThings approval process includes a code review that ensures that things like that don’t happen.

@tgauchat

Quite incorrect, Geko: The review process absolutely does not prevent that from happening even via fully approved and published web services SmartApps.

I understand that the ToU indemnify SmartThings from any damages resulting from the use of third-party apps and services. However it’s no different than Apple AppsStore ToU in this regard. The review process constitutes due diligence and gives me as a customer peace of mind that the third-party app meet SmartThings publication criteria and is free from malicious code.

Therefore I would not recommend using unpublished, closed-source SmartApps to anyone.