Is there any security issues with having the QR code sticker exposed in a product? Just curious, since the particle product pages blur it out.
In my understanding, the data matrix, much like the device ID, is a unique identifier for the hardware that is connotated with ownership of the device. Like it is good practice to not expose the device ID, it’s also advisable to not expose the data matrix.
As far as security goes, I think exposing the data matrix is less of a risk than exposing the device ID, since a potential attacker could do more harm with knowledge of the device ID than the data matrix. In a product, devices are usually already imported into the product before they are deployed in the field, and as far as I know, if a device is already claimed and belongs to a product, the data matrix isn’t really useful anymore.
If you are concerned about the security risks of leaving the data matrix exposed I would recommend obscuring the code with a marker. There are ways to configure mesh networks and claim devices without using the data matrix or the mobile app via the CLI.
I believe the product pages blur out the data matrix for the same reason they don’t include real device IDs: to make it obvious that those sections of the documentation are not explicitly applicable to exclusively those devices, and to deter users from attempting to claim or communicate with devices other than their own, real or not.
1 Like