Google’s discontinued Nest Learning Thermostats continue to transmit data to the company, raising significant privacy concerns despite the loss of smart features.
Google’s Nest Learning Thermostats, particularly the first and second generation models, are still sending data to the company’s servers even after the discontinuation of their remote control features. This revelation has sparked serious privacy concerns among users who believed that their devices would cease communication with Google once these features were removed.
Last month, Google officially shut down the remote control capabilities for these older Nest models. Many owners assumed that this would also mean an end to any data transmission. However, recent research has uncovered that these devices continue to upload detailed logs to Google, despite the cessation of support.
Security researcher Cody Kociemba made this discovery while participating in a repair bounty challenge organized by FULU, a right-to-repair group co-founded by electronics expert and YouTuber Louis Rossmann. The challenge aimed to encourage developers to restore lost functionalities in unsupported Nest devices. Kociemba collaborated with the open-source community to create software called No Longer Evil, which aims to reinstate smart features to these aging thermostats.
While working on this project, Kociemba unexpectedly received a large influx of logs from customer devices, prompting him to investigate further. He found that even though remote control features were disabled, the early Nest Learning Thermostats still transmitted a steady stream of sensor data to Google. This data flow included various logs that Kociemba had not anticipated.
In response to this situation, Google stated that unsupported models would “continue to report logs for issue diagnostics.” However, Kociemba pointed out that since support has been fully discontinued, Google cannot utilize this data to assist customers, making the ongoing data transmission perplexing.
A Google spokesperson clarified that while the Nest Learning Thermostat (1st and 2nd Gen) is no longer supported in the Nest and Home apps, users can still make temperature and scheduling adjustments directly on the device. The spokesperson added that diagnostic logs, which are not associated with specific user accounts, would continue to be sent to Google for service and issue tracking. Users who wish to stop the data flow can disconnect their devices from Wi-Fi through the on-device settings menu.
Despite the removal of remote control, security updates, and software updates through the Nest and Google Home apps, these thermostats still maintain a one-way connection to Google. This situation raises concerns about transparency and user choice, particularly for those who believed their devices had been fully disconnected.
The FULU bounty program encourages developers to create tools that restore functionality to devices that manufacturers have abandoned. After reviewing various submissions, FULU awarded Kociemba and another developer, known as Team Dinosaur, a top bounty of $14,772 for their efforts in bringing smart features back to early Nest models. Their work underscores the potential of community-driven repair initiatives to prolong the life of useful devices while also shedding light on how companies manage device data after official support has ended.
For users who still have unsupported Nest thermostats connected to their networks, there are several steps they can take to enhance their privacy. First, users should check what data Google has linked to their home devices by visiting myactivity.google.com and reviewing thermostat logs or unexpected events.
Setting up a guest network can help isolate the thermostat from main devices, limiting its access and reducing potential exposure. Some routers allow users to prevent individual devices from sending data to the internet, which can stop log uploads while still enabling the thermostat to control heating and cooling.
If the device menu still offers cloud settings, users should disable any options related to remote access or online diagnostics. Even partial controls can help minimize data transmission. Additionally, users should review their connected devices in Google settings and remove any outdated Nest entries that no longer serve a purpose, effectively stopping any residual data flow.
Some routers may send analytics back to the manufacturer. Turning off cloud diagnostics can further reduce the data footprint of unsupported smart products. Since unsupported devices do not receive security updates, users unable to isolate the thermostat on their network may want to consider upgrading to a model that still receives patches.
For those concerned about their personal information, a data removal service can assist in reducing the amount of data available to brokers. While no service can guarantee complete data removal from the internet, these services actively monitor and erase personal information from various websites, providing peace of mind for users.
The ongoing data transmission from older Nest thermostats, even after the loss of their smart features, prompts users to reassess their connected home devices. Understanding what data is shared can empower consumers to make informed decisions about which devices to keep on their networks.
Would you continue using a device that still communicates with its manufacturer after losing the features you initially paid for? Share your thoughts with us at Cyberguy.com.
Source: Original article