Automagic Forum

So I use SMS with Automagic for out of band messaging between two Automagic instances (one on a device at home and one on my mobile including when I'm not not at home - all for unidirectional IOT/remote control). This is particulary good if my home internet connection is down and I can command a router power cycle to try and fix it remotely

Assuming I had to avoid SMS and use an IP based connection instead, what would be the recommened relatively secure way to talk between Automagic instances? I know I wouldn't be able to do a router reboot if the internet connection had gone down, but for other uses:

- I could use email. I can certainly send emails from Automagic, but receiving is perhaps a little clumsy as I need a separate email client that Automagic has access to on the receiving end (e.g using trigger K-9 Mail Received)
- I may (?) be able to use a 3rd party service like IFTTT with Automagic triggering off IFTTT notifications, but again an extra complication and source of unreliablity
- Somehow use another Google service (e.g. Calendar triggers and actions)?
- Anyone have any other ideas/use another method?

HTTP Request trigger/action? But it's not secure at all. Though SMS is not secure too. And email.

You can directly control router via SSH (Execute SSH Command). Pubkey auth security level is enough I guess.

I think it is possible too to go from the google assistant. But maybe that is limited to google home devices.

I ever prooftest using whatsapp. You can add whatsapp number in the target phone. Create a flow to watch for notification from you. Of course you have to save the name for the number and use this whatsapp number for this purpose only. After receiving the chat, it will remove the notification and open it in whatsapp (or mark as read if the phone support it). This is to ensure no stacked chat later. Execute the command stated in the chat and do all stuff.

In the sender phone, you can use create the command first in script and just use Whatsapp API to send it, still have the UI distraction as you need Control UI to confirm the send.

You can use any other chatting app for this. I only know the whatsapp API. Don't know if other app have it.

If you need stronger security :
- whatsapp is already end-to-end encryption. But the message still go thru their server
- you can encrypt the whole command before sending it. Probably you can use openssl, but you have to install it in both devices (probably require root)
- you don't encrypt the command, but include a hash from part of the command, appended to some secret word and date (and time within hour/minute). So the hash will changed for different command and different date, and you still have the secret word. Automagic has the hash function inside the script.

But let's just hope for the best. The outrage at the issue tracker still going on. At least let's hope all automation apps will be excluded (specifically Automagic)

Desmanto wrote:If you need stronger security … whatsapp

Still, «security» and «whatsapp/telegram/any commercial IM» is a mutually exclusive. API is not guaranteed stable too. In any way, implement secure «RPC-over-IM» is feasible, but not simple and trivial. As a whole, this is not a reliable way, especially using third-party app and UI.

The only suitable thing I remember is a XMPP+OTR, but we need XMPP client implemented in AM.