Recalled: Making a Tasmota device smarter, really smarter !

[rin67630]

Unfortunately I have to recall that tutorial.
Tasmota has a huge security flaw and cannot provide TLS encryption on an ESP8266.
An attacker can very easily hijack your device if you do MQTT without encryption.

~~Give Tasmota devices customizable dashboards

• requiring no additional hardware, - no computer, no gateway, no Grafana, no database,
• using (almost) no gibberish to configure
• requiring no coding, nothing to install, nothing to screw, nothing to solder...
• at no cost, requiring no subscription, nothing expires into pay schemes, no credit card asked for...
  That's what I call smart !

That additional dashboard is a bonus to give you :

• an overview on time series lacking in Tasmota.
• a monitoring ability when you are not at home. (without need to fiddle with opening ports and leased IPs)
  You often lose that feature -essential for many- upon reflashing a commercial device to Tasmota.

After following all instructions , you get a dashboard like that one, that you can call worldwide, modify to your preferences tweak, etc...:
~~

Documentation in the comments.

[rin67630]

What will yo do to get that?

• create a free lifetime account at thinger.io.
  (that company lives from selling their iot dashboards to corporations as SaaS subscriptions, and provides a limited free
  account for up to 2 devices, 4 buckets, 4 dashboards...)
• create there a "device"
• configure Tasmota to match their integrated MQTT broker
• create there a "data bucket" to receive your data
• verify incoming data into the bucket
• create a "dashboard" to display your information.

All that takes 20 minutes to follow the step-by-step instructions.

I will use a Tasmota enabled Smart Plug for my example, but any other Tasmota IoT device can be used.

[rin67630]

Create a lifetime Free account at Thinger.io

Go to https://thinger.io, click on "try it for free". (there is no catch, no credit card required, lifetime free for limited usage)
Enter the data

Confirm the received mail, log in, your account is set up.

Create there a "device"
Click on the "Devices" cercle in the block Account stats
Create a device
Enter a device name, descriptions as you like and a device credential. Note that credential and the device name, you will need it with your user name to configure Tasmota.

configure Tasmota to match their integrated MQTT server
Go to the Tasmota page, Click on Configurtion, configure MQTT, Enter the data:

The Host in mandatory, the port can be set to 8883 if you want to ger cyphered.
The Client is your device name, the user your Account user, the password is your device credentials (not your account password !)
You might change the Topic, leave the Full Topic as is. Save.
Go to Configure, Other and enable MQTT. Save.
Go to configure, Logging and change the telemetry period to 60. Save.
Got to the console of Tasmota
look that messages are issued
Note the exact wording of the topic.

Return to console.thinger.io
Your device should be online

Return to the thinger.io front page.
create there a "data bucket" to receive your data
Return to the console,
Click on the "Buckets" cercle in the block Account stats
Create a Bucket

You are free to name devices and buckets like you want, it must be one word and cannot be changed later.
The topic must be exactly matching those of the tasmota's console
Save your bucket.

From now on, your bucket should populate every minute.
(If not, verify that you have exactly matching data and you have saved every step)
Your bucket should be populated similarly to that one:

Buckets can also be exported to a spreadsheet by the way....

Now we are ready to design your dashboard.
to be continued...

[rin67630]

create a "dashboard" to display your information

From the thinger.io console, you click on the Dashboards Circle and then to "add dashboard"

Enter a dashboard name and descriptions as you like.
Click on "Add dashboard"
You get an empty dashboard with a pad+pencil symbol at the top right. Click on it, then on Add Widget immediately left.
Configure like described here:

• https://docs.thinger.io/features/dashboards#display-widgets
• https://docs.thinger.io/features/dashboards#text-value
• https://docs.thinger.io/features/dashboards#tachometer-chart
• https://docs.thinger.io/features/dashboards#time-series-chart

These are the widgets I have used on my example.

Once you have chosen your widget type, enter the data source, which is always "from data bucket" and then select the bucket and the value:

In the tabs "Display options" and "Widgets" you can customize the appearance of your widget, enter Units and a description text.
Finally save your choice. You get a new widget in your dashboard.

please note the three symbols on the right top of the widget, with them you can

• duplicate your configured widget (and just change the data instead of redoing everything from scratch,
• re-enter in configuration mode
• delete the widget.
  So you can duplicate the first "current" widget into a "voltage" copy and so on...
  Finally you leave the dashboard configuration with clicking on
  

Later yo can toggle anytime between configuration and display-mode.
Happy Dashboard creation !

For the impatient who immediately want my nice configured dashboard without going through every widget, I will give a shortcut in the next message.

[rin67630]

** Preconfigured Energy dashboard **
Open your dashboard stub.
Click on the pad+pencil to enter configuration, then on "Settings"

Open a text editor on your computer.
Paste this configuration:
{ "description": "Grid-Tie-Inverter", "name": "80Tasmota", "placeholders": { "sources": [] }, "properties": { "background_image": "#222222", "border_radius": "10px", "row_height": 16 }, "tabs": [ { "icon": "fas fa-tachometer-alt", "name": "80Tasmota", "widgets": [ { "layout": { "col": 2, "row": 0, "sizeX": 1, "sizeY": 12 }, "panel": { "color": "#333333", "currentColor": "#333333", "showOffline": { "type": "none" }, "subtitle": "Grid-tie inverter", "title": "Voltage" }, "properties": { "color": "#0080ff", "decimal_places": 1, "icon": "", "size": "75px", "unit": "Watt", "unit_size": "20px", "weight": "font-thin" }, "sources": [ { "bucket": { "backend": "dynamodb", "id": "80Tasmota", "mapping": "ENERGY.Power", "tags": {} }, "color": "#1abc9c", "name": "Source 1", "source": "bucket", "timespan": { "mode": "latest" } } ], "type": "text" }, { "layout": { "col": 0, "row": 0, "sizeX": 1, "sizeY": 12 }, "panel": { "color": "#333333", "currentColor": "#333333", "showOffline": { "type": "none" }, "subtitle": "Grid-tie inverter", "title": "Current" }, "properties": { "color": "#ff8000", "decimal_places": 3, "icon": "", "size": "75px", "unit": "Amp", "unit_size": "20px", "weight": "font-thin" }, "sources": [ { "bucket": { "backend": "dynamodb", "id": "80Tasmota", "mapping": "ENERGY.Current", "tags": {} }, "color": "#1abc9c", "name": "Source 1", "source": "bucket", "timespan": { "mode": "latest" } } ], "type": "text" }, { "layout": { "col": 1, "row": 12, "sizeX": 1, "sizeY": 24 }, "panel": { "color": "#333333", "currentColor": "#333333", "showOffline": { "type": "none" } }, "properties": { "majorTicks": 10, "max": 250, "min": 200, "plateColor": "#61605f", "showValue": true, "textColor": "#1E313E", "tickColor": "#00ff00", "unit": "Volt" }, "sources": [ { "bucket": { "backend": "dynamodb", "id": "80Tasmota", "mapping": "ENERGY.Voltage", "tags": {} }, "color": "#1abc9c", "name": "Source 1", "source": "bucket", "timespan": { "mode": "latest" } } ], "type": "tachometer" }, { "layout": { "col": 1, "row": 0, "sizeX": 1, "sizeY": 12 }, "panel": { "color": "#333333", "currentColor": "#333333", "showOffline": { "type": "none" }, "subtitle": "Grid-tie inverter", "title": "Voltage" }, "properties": { "color": "#00ff00", "decimal_places": 1, "icon": "", "size": "75px", "unit": "Volt", "unit_size": "20px", "weight": "font-thin" }, "sources": [ { "bucket": { "backend": "dynamodb", "id": "80Tasmota", "mapping": "ENERGY.Voltage", "tags": {} }, "color": "#1abc9c", "name": "Source 1", "source": "bucket", "timespan": { "mode": "latest" } } ], "type": "text" }, { "layout": { "col": 0, "row": 12, "sizeX": 1, "sizeY": 24 }, "panel": { "color": "#333333", "currentColor": "#333333", "showOffline": { "type": "none" } }, "properties": { "majorTicks": 1, "max": 4, "min": 0, "plateColor": "#888888", "showValue": true, "textColor": "#000000", "tickColor": "#ff8000", "unit": "Ampere" }, "sources": [ { "bucket": { "backend": "dynamodb", "id": "80Tasmota", "mapping": "ENERGY.Current", "tags": {} }, "color": "#1abc9c", "name": "Source 1", "source": "bucket", "timespan": { "mode": "latest" } } ], "type": "tachometer" }, { "layout": { "col": 2, "row": 12, "sizeX": 1, "sizeY": 24 }, "panel": { "color": "#333333", "currentColor": "#333333", "showOffline": { "type": "none" } }, "properties": { "majorTicks": 100, "max": 600, "min": 0, "plateColor": "#61605f", "showValue": true, "textColor": "#1E313E", "tickColor": "#0080ff", "unit": "Watt" }, "sources": [ { "bucket": { "backend": "dynamodb", "id": "80Tasmota", "mapping": "ENERGY.Power", "tags": {} }, "color": "#1abc9c", "name": "Source 1", "source": "bucket", "timespan": { "mode": "latest" } } ], "type": "tachometer" }, { "layout": { "col": 0, "row": 54, "sizeX": 3, "sizeY": 18 }, "panel": { "color": "#2f2f2f", "colors": [], "currentColor": "#2f2f2f", "showOffline": { "type": "none" }, "subtitle": "Grid-tie Inverter", "title": "Voltage/Current" }, "properties": { "axis": true, "fill": true, "legend": true, "multiple_axes": true }, "sources": [ { "bucket": { "backend": "dynamodb", "id": "80Tasmota", "mapping": "ENERGY.Voltage", "tags": {} }, "color": "#00ff00", "name": "Voltage", "source": "bucket", "timespan": { "beginTs": "2024-08-30T13:13:00.000Z", "endTs": "2024-08-30T13:13:00.000Z", "magnitude": "hour", "mode": "relative", "period": "latest", "value": 24 } }, { "bucket": { "backend": "dynamodb", "id": "80Tasmota", "mapping": "ENERGY.Current", "tags": {} }, "color": "#ff8000", "name": "Current", "source": "bucket", "timespan": { "magnitude": "hour", "mode": "relative", "period": "latest", "value": 6 } } ], "type": "chart" }, { "layout": { "col": 0, "row": 36, "sizeX": 3, "sizeY": 18 }, "panel": { "color": "#2f2f2f", "colors": [], "currentColor": "#2f2f2f", "showOffline": { "type": "none" }, "subtitle": "Grid-tie Inverter", "title": "Energy gathered" }, "properties": { "axis": true, "fill": true, "legend": true, "multiple_axes": false }, "sources": [ { "bucket": { "backend": "dynamodb", "id": "80Tasmota", "mapping": "ENERGY.Today", "tags": {} }, "color": "#0080ff", "name": "Energy Today", "source": "bucket", "timespan": { "beginTs": "2024-08-30T13:13:00.000Z", "endTs": "2024-08-30T13:13:00.000Z", "magnitude": "hour", "mode": "relative", "period": "latest", "value": 24 } } ], "type": "chart" } ] } ], "widgets": [] }
Replace every occurrence of "80Tasmota" with your own bucket name (Search and Replace does that in a breeze)
Copy the modified code and paste it to your developer view.
Enjoy the ready made dashboard, that you can now tweak to your needs.

[Jason2866]

Nice as long the lifetime of this cloud solution is longer than a few years ;-)
Tasmota is made to get away of this vendor lock in Cloud Solutions. No fun at all when the company does stop business. There are many examples for this.

[rin67630]

Thinger.io is in business since 2015. Should they stop business, you could always figure another Dashboard solution.
You have lost nothing, excepted an hour to configure and had meanwhile a nice time for free...
Tasmota is not impacted, and is fully operational all the time.
Thinger.io is just all bonus, not the main driver.

[valdus2]

I don't think Tasmota gets smarter from a dashboard....not even us. Easier maybe, smarter no.

I hate cloud and I want to be self contained for life, so for now I prefer some freeboards....
Sample:

[sfromis]

You might see more interest if the project matched Tasmota in being an open source project available for local install, and possible customization. That would not preclude it from also being available in a cloud setup, even if a main point of installing Tasmota on commercial plugs, lights and so on, is to avoid being dependent on cloud access. Still do expect that being dependent on an external server is a big no-no for a lot of Tasmota users.

[rin67630]

"still do expect that being dependent on an external server is a big no-no for a lot of Tasmota users"
Fully agree. My additional dashboard is a bonus to give you :

• an overview on time series lacking in Tasmota.
• a monitoring ability when you are not at home.
  You often lose that usually "commercial" features -essential for many- upon reflashing a device to Tasmota.
  That is also the very reason for Tasmota offering a MQTT service.
  And -pardon me- opening ports for remote control and fiddling with leased IPs is, for most of us, the last thing they want to do and can.
  Local is nice, remote too, both is the best.

[rin67630]

You might see more interest if the project matched Tasmota in being an open source project available for local install, and possible customization.

But you can't have an open-source solution that needs no additional hardware, no installation. That is my point.
If you want additional time series trends and remote access from everywhere, you need cloud resources that someone has to provide.

Of course you can set up your own OpenSource based MQTT broker, run an Influx database, Grafana and put all that on a fixed IP provider. But that will be far from being cost-free, simple and accessible to noobs in less than an hour.

[sfromis]

Your "point" did not even address what I wrote, including "available for local install". Most of the time this would obviously not need additional hardware, as it is pretty standard that users running Tasmota also has a small server running with a broker and a backend platform like Home Assistant. And I think that very few would even consider leasing server space for such a setup, when a lot of the point already is to keep it local.

And I also mentioned that the option of being able to do local install would not preclude it also being available in a cloud setup, more like this would just not appeal to Tasmota users. Part of this is that Tasmota is not really aimed at "consumer users", but instead users who want to play around with tech stuff.

(Of course, users following what happens here on Github would certainly already be leaning towards the techie side)

[rin67630]

as it is pretty standard that users running Tasmota also has a small server running with a broker and a backend platform like Home Assistant.

I were not that sure about that. Who has built that stuff at home belongs to another category not needing any clue.
But dont't assume that every Tasmota user is a nerd.
You have many products directly sold with Tasmota.
Example: Someone just wanting to see how his water boiler behaves over time and how much energy it consumes, shifting it's power into solar powered times, may just buy a cheap Tasmota enabled plug and get an hour later from scratch a working fully configurable working dashboard:

But you are fully right: that guy will not come here on Github.
That is why I will publish my approach on Instructables.com and maybe on YouTube too.

[Pietjuhbel]

Am I missing something here or are you really suggesting it's a good idea to send mqtt in plain text to an endpoint on the internet like it's 2002

[rin67630]

You may use port 8883 if you want encryption.
But what information would you fear to disclose?

[barbudor]

TLS is mandatory to use a broker in the cloud
Sending in clear means that smart hackers could easily get access to your system and messes it up

There are already a lot of Tasmota devices open in the field that anyone could mess with, don't add more

[Pietjuhbel]

Since the username and password are also send in clear anyone who can sniff the traffic can join the party and controll your device.
Like barbudor said, just don't do this.

[rin67630]

Not a huge issue to change the port to 8883.
But why is 1883 the indicated default on Tasmota?

[sfromis]

Because the large majority of users are better served with port 1883 (non-TLS) on their own network. Using a public broker is an edge case for users opting for a more complex setup, which is not just changing port numbers, as TLS needs key management and such.

[Pietjuhbel]

Because tasmota does not by default have TLS support at least not on Esp8266 neither does the one in your example.
You have to compile it yourselve in order to have Tls support.
What we are trying to point out is you shouln't write tutorials that are inherently insecure and target people that are not nerds.

[s-hadinger]

You could then display a warning if TLS is not enabled and the ip address does not adhere to the spec.

As explained above, this is not straightforward with the current architecture, because such test must be made when the MQTT lib makes the TCP connection, which silently makes a DNS resolution. Currently the MQTT lib does not care about the IP address, and doesn't even know it.

As said above also, issuing a warning in the logs has limited effect because users tend to not look at logs unless there is a problem.

Edit: I agree with @Pietjuhbel, the core issue is: opening unencrypted endpoints on the internet. It's wrong to assume that clients will be smart enough to not use an open endpoint. It should be the other way around; whatever the level of warnings we can add.

[rin67630]

I agree with @Pietjuhbel, the core issue is: opening unencrypted endpoints on the internet. It's wrong to assume that clients will be smart enough to not use an open endpoint. It should be the other way around; whatever the level of warnings we can add.

Yes, fully agree, that it's wrong to assume that users will be smart enough to not use an open endpoint.
That must already be prevented by the message issuer (Tasmota) with the highest priority.

But the core issue is that Tasmota enables changing the OTA server from MQTT, beside not supporting encryption for the vast majority of its installed base. That is a unique flaw in the IoT world !
Hijacking a Tasmota device is ridiculously simple and is a threat to the whole Internet world.

[rin67630]

So if the bank does not allow unencrypted traffic why should your cloud service allow it. It's just ridiculous.

Other way around is right: why does Tasmota not prevent it?
Even if the receiver does not accept it ( and thinger.io will not accept unencrypted messages on port 8883 ) that does not prevent Tasmota to issue them continuously to the internet without a warning exposing the data anyway.

[Pietjuhbel]

So if the bank does not allow unencrypted traffic why should your cloud service allow it. It's just ridiculous.

Other way around is right: why does Tasmota not prevent it?

Because Tasmota does not host insecure mqtt brokers in the cloud and neither should you.

[s-hadinger]

But the core issue is that Tasmota enables changing the OTA server from MQTT, beside not supporting encryption for the vast majority of its installed base. That is a unique flaw in the IoT world ! Hijacking a Tasmota device is ridiculously simple and is a threat to the whole Internet world.

Please stop being over-dramatic. We have already explained that Tasmota is primarily designed to be connected to a local MQTT gateway in a walled-garden environment. There is no "threat to the whole internet world" if you use Tasmota as it is designed to be used.

Not including TLS on ESP8266 is not a choice, it's a constraint. You should be grateful that I spent countless hours to make TLS small enough that it can be used on ESP8266, as long as you accept to compile a specific build for your needs.

Tasmota is open-source. Nobody forces you to use it. If you are not happy with it, you have the opportunity to tune it to your own needs.

[s-hadinger]

@rin67630 I have still not seen any specific and precise enough request that we should implement in Tasmota. Please expose your suggestion.

Otherwise I will close this discussion that has gone off-topic

[rin67630]

I have requested the admins to delete the whole thread and issued a security warning concerning the change of OTA-Address to Tasmota.

EOD.

[s-hadinger]

Discussion is now closed and locked.