Horrible Network Security, Mixed Messages about Safety, but works.
GOOD: this collects a weight and syncs that weight to fitbit’s dashboard as I expected. The weight is quick.<br /><br />BAD: Wi-fi range is poor (despite being 2.4 Ghz [and only 2.4Ghz]). It’s slow to do the BF % measurement. I’ve found the BF measurements to have very low test-retest reliability.<br /><br />INEXCUSABLE: The setup experience on this scale is horrible and I cannot see any way for a typical consumer to do the setup OR operate the scale in a secure fashion. The UX is just bad project management the security issues are the deal breaker that prompted the rating.<br /><br />User “mrgunn” in the FitBit forum thread titled “Aria Wifi ERR solution for new routers which support 802.11ac” gave an amusing tongue-in-cheek flavor for what is required to setup this scale up in the least insecure way possible. Before you buy please read “mrgunn’s” post and be sure you are prepared for a 50 step setup adventure.<br /><br />Even once you are done with “mrgunn” you are worse off: the low-complexity key that this scale requires to connect is no way to operate a network. The biggest problem isn’t the UX, it isn’t even that your best case is less secure, it’s that the path to worse off is so complex that many people won’t get to minimally worse off and will instead operate dramatically less secure networks out of a frustrated desire to have their glossy new scale working and limited understanding of the risk. Someone will be victimized needlessly as a result of this “wide open is all that works”. For me this was a fun weekend project and chance to feel pleased about having RJ45 in the bathroom*. For most people this is an early adoption laserdisc moment. For someone this could be the entry point to a crippling identity theft.<br /><br />UNTESTED: I don’t need multi-user. I could imagine this being a nice feature feature and a trivial problem (e.x. a highly diamoprhic couple) to solve. I could also imagine it being nearly intractable (say men’s lightweight rowers living together). Given the security and the BF issues I question their ability to execute in the face of complexity.<br /><br />FYI: I read a bit about this scale before buying it and was surprised to open it and find a big warning label about pacemakers, kids, and pregnancy on the scale. Neither is relevant to me so I assumed I’d just glossed over them. Quick re-read suggest they are hiding in the fine print and Googling yields inconsistent information on fitbit.com. This is poor form. The safety info should be front and center and the evidence / risk should go with it (in this case I’d wager this is a lack of evidence not evidence of harm).<br /><br />TL;DR – nice “weigh you and save it” function, horrible consumer protection / security practice. Why the extra star? It can be used safely. It’s just a lot of work.<br /><br />*HOW TO USE: Knowing what I know now setup for this could actually be easy…<br />- You’ll have to have a dedicated ultra low power 2.4ghz AP for the scale (and only the scale) to connect to. I used an old router running dd-wrt and turned transmit power down until the signal didn’t escape my bathroom. The limit case value here is reduced interference with my real signal but piratically speaking this does really change the physicality of exploitation.<br />- Granting that “just whisper rarely” isn’t security you’ll have to treat this AP’s back-haul as insecure. For me it was easiest just to put the bathroom network drop’s port (you’ve got gigabit to your toilet right?) on an isolated vlan for the reduced power AP’s back-haul.<br />- Now that you’ve planned to mitigate the harm of this scale you can setup a burner Linux VM and use it to do the wi-fi dance with your custom lower power minimal security AP in your walk in Faraday cage from a burner VM.
Rating: 2 stars