EEVblog® Electronics Community Forum
Products => Dodgy Technology => Topic started by: MrMobodies on October 06, 2022, 05:30:47 pm
-
I posted about this before in other threads but found something else shocking that I think it is worthy of its own thread.
So far they have locked the local API to read even things like the battery so you depend on internet and their website, restrict access citing security concerns to move local appliances onto a token system (free with a limited amount of 'hits') but even when they made this change it could be intercepted all the time as someone made a script below:
https://support.enphase.com/s/question/0D53m00006ySLuRCAW/unimpressed-with-loss-of-local-api-connectivity-to-envoys
Jeremy Walton (Moderator) 8 months ago
We understand that certain users want their energy systems connected only locally, and to dispense with our token authentication process. However, our token authentication solution is currently applicable to all locally-connected Envoys, and we stand by this decision which we feel gives an enhanced level of security for such systems :bullshit:, where unauthorized access is largely in the hands of the system-owner. To be clear, we did not move to token-based authentication to obstruct users from obtaining their own data or to somehow profit from that (which we do not).
To clarify a misunderstanding around this issue, tokens for system-owners are valid for 6 months and therefore present extremely low inconvenience and risk that a token expires during an extended outage. If you are receiving a shorter token (1 hour or 12 hours) then the problem is likely that you are logging in as “installer” and you will need to use a “system-owner” enlighten account instead. Customer Service can assist with this.
Leroy_937. 9 days ago
@Stephens_8395 Sure :)
You need to intercept traffic from the Envoy and route it to an nginx server. For this, setup iptables on your router (or on the gateway declared in the Envoy interface) like this:
iptables -t nat -A PREROUTING -s 192.168.0.32/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.30:8000
iptables -t nat -A PREROUTING -s 192.168.0.32/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.30:8443
iptables -t nat -A POSTROUTING -s 192.168.0.32/32 -j MASQUERADE
where 192.168.0.32 is the Envoy IP, and 192.168.0.30 is the reverse proxy.
On the reverse proxy, install nginx, and setup the following virtual hosts:
server {
listen 8000;
listen [::]:8000;
server_name reports.enphaseenergy.com;
location /emu_reports/performance_report {
proxy_pass http://reports.enphaseenergy.com:80; (http://reports.enphaseenergy.com:80;)
}
location / {
return 204;
}
}
server {
listen 8000;
listen [::]:8000;
server_name home.enphaseenergy.com;
return 200;
}
server {
listen 8443 ssl;
listen [::]:8443 ssl;
server_name reports.enphaseenergy.com;
include snippets/snakeoil.conf;
location /emu_reports/performance_report {
proxy_pass https://reports.enphaseenergy.com:443; (https://reports.enphaseenergy.com:443;)
}
return 204;
}
server {
listen 8443 ssl;
listen [::]:8443 ssl;
include snippets/snakeoil.conf;
server_name home.enphaseenergy.com;
return 200;
}
I don't see anything about tokens there or maybe it takes place on another appliance that sends it to the website.
So if the system owner obtains data locally from their equipment, that is not okay but if a hacker does it or a bot through interception that's alright then.
we stand by this decision which we feel gives an enhanced level of security for such systems
Sounds like an enhanced level of security to ONLY stop their customers from seeing the statistics locally.
Isn't that disgusting?
Looks to me like a token/fee based system that is only put there to lock out the user from the front end by pretentious means when nothing has really changed in security across the devices.
So basically they have lied.
What do you think?
Just changed the title to something a bit better.
-
we stand by this decision which we feel gives an enhanced level of security
Explaining security decisions by feelings is tipical to security theater. Do they have a technical explanation for this decision somewhere else ?
PS: I also feel that Enphase is falling from my upgrade options.
-
It seems that they have this "Eco Partner" program where other companies have access to their customers details.
https://www4.enphase.com/en-uk/residential-solutions/partners
Our Partner Ecosystem
When you work with Enphase, you get access to our resources as well as those of the trusted companies we work with. Find help for your current project or to take your business to next level. Search and select from the list of our residential partners below.
Residential solutions partners
Keep working with the companies you trust, because we work with them, too.
Residential design and monitoring partners
Let our software partners make your life easier, with faster AC system designs and smarter monitoring.
Very vague.
I find this thread:
https://support.enphase.com/s/question/0D53m00006x3LLaCAM/ive-received-a-warning-letter-today-from-a-company-called-eco-partners
Major_Sarcasm asked a question. June 7, 2021 at 7:59 PM
I've received a warning letter today from a company called Eco Partners...
Their letter was quite strongly phrased, implying that my microinverters would cease to function due to a bug in firmware 18.05 causing a data build-up and subsequent overwrite of the grid profiles. I checked my Envoy-R with the Enphase Enlighten app and it states that everything is normal and that it has firmware R3.17.3 installed. I noted that I'm unable to connect to the Envoy locally though, despite everything else appearing to be normal.
Are Eco Partners trying to scam me here or is the warning in their letter a legitimate concern? My installer has ceased trading so unable to ask them.
Thanks for the assistance.
Steve
Clare_6724 a year ago
Hi I have an Eco partners engineer telling me if I don’t pay the £1375 my system will stop working ?
is this correct ?
https://forums.moneysavingexpert.com/discussion/5855710/solar-panel-maintenance
13 June 2018 at 9:21AM in LPG, heating oil, solid & other fuels Devilment666
Hi, I got a phone call on Mon 11th regarding my Solar panel installer (AES Ltd) going bust from a company called Eco Partners Ltd.
They basically told me that my Solar panels haven't been cover by a maintenance contract or insurance for two years which is when the company went bust. They have offered various packages to take over the maintenance of them and no surprise they want paying for it and if I sign today then they will give it to me for cost price. My problem is that Eco Partners have quite a sketchy past according to Companies house but they are a registered installer for Enphase (the company who make the parts for the solar system) so kinda stuck what to do.
No-one replies to emails quickly and no-one picks up the phone or you get a message telling you they only speak to installers.
I have tried to email RECC but got no response as yet. Feels so much like a con but don't want a white elephant sat on my roof.
Sorry for the long post but need help asap.
Damian
29 November 2018 at 11:50AM Tez_Ex
Hi
...
My original installer ceased trading almost 2 years ago but just this week I received a phone call and subsequent visit from a company called ECO Partners Ltd who are based in Bradford They informed me that they have been contracted by Enphase (my system supplier) to take over the monitoring operations of all Enphase Envoy Enlighten systems in the UK due to the fact that Enphase are predominantly interested in the Commercial sector and not the Private homeowner sector of the market.
ECO Partners informed me that over a period of time there would be a cumulative build-up of software issues in the microinverters that would result in them producing less and less power output :bullshit: until they eventually stopped working unless they received regular software updates that would be provided via their monitoring of the system
They offered me a Maintenance and Monitoring service over a period of 10 or 20 years with 3 options available to me and of course 3 different costs Of course all the offers on the table required a 20% deposit there and then due to them being 'So busy we will not be able to return anytime in the near future' The costs quoted were £1250, £2000, £2995 and I didn't have the option to see all this in writing or even check my current finances to see if i could afford it or not
The whole thing did indeed seem like a scam
I've done a little digging and also asked Enphase for their take on all this and asked them if ECO Partners are indeed a trusted partner but as yet have received no reply
My questions to any one with any knowledge out there would be
...
Cheers!
28 May 2019 at 11:30AM Sterlingtimes
I had Eco Partners on the telephone today. I was told that the Enphase micro inverters "get clogged up with data over time" and may then stop working. :bullshit: This would rather suggest the product provided by Enphase (now partnered with Eco Partners) was not fit for purpose under the Sale of Goods Act. It was never represented to the buyer at the point of sale that the microinverters would stop working because they become clogged up with data.
Enphase separately emailed me to offer a self panel level monitoring facility for £9.99 a month.
24 September 2019 at 3:34PM mickmorley
It's the same story as above: microinverters will stop working if not updated via EnvoyR, which is now superseded. I have a "quotation" for the three options if we need it later. I told Carl Mowbray of ECO Partners that it sounded like a scam and that I wouldn't be agreeing to anything until I had researched other people's experiences. What I am concerned about is whether they now have enough information to access and control my system without my permission. Any ideas/suggestions?
25 September 2019 at 9:03PM Glacial
We also had Carl Mowbray of Eco Partners trying his best to convince us that our micro inverters will fail if the software is not updated. He also tried to tell us that the panels were not functioning as they should be. Yet we have been monitoring the whole system since it was installed and we still get as much energy produced on cloudless days now as we did in 2014.
I have yet to find any online confirmation that Enphase inverters will shut themselves down if they can't export their performance data. If this is a real fault, then Enphase have a serious flaw in their design and one would expect to see some internet traffic on the subject.
7 December 2019 at 12:46PM Marylovestodance
Just found this thread after a 1.5 hour sales visit from 'solar engineer' Carl from Eco-partners. We nearly fell for it. Two of our panels aren't performing as well as they could and we have been wondering what to do..... then came a call from a woman claiming that Enphase have given the work of updating the software on their systems to Eco-partners and that they are going around the country visiting everyone with panels from companies no longer trading. It sounded like a good thing so I agreed to a visit.
Carl was friendly as are all salesmen and sat down with us to 'explain' our situation. He told us the story about the inverted going off of they don't download their data. :bullshit: He also told us some absolute rubbish that because our Envoy device was in dining room and not next to the meter interference from washing machine could affect the readings. Then came the hard sell £1375 for 10 years service, a 20 year option and one with a battery. Carl assured us Eco-partners would stay in business as Enphase is a world leading solar supplier; an odd sort of logic. We weren't sure what to do and initially signed up (as well aware of the 14 day cool off period). Further research and thinking and we cancelled the next day.
Companies House data shows Eco partners to have been trading since 2012 but theh were dormant until 2016. Hardly the sort of company to pass £1375 to upfront. I did ask Carl why it couldn't be an annual contract but he admitted they needed to get the money in.
As for the Envoy unit; Carl reckoned they cost over £800 and they would fit is a new one next to our meter (LOL)! We found on online for just over £200. Even if the Enviy stops working the electricity is still being exported to the grid and the payments will continue.
Carl tried to impress us by logging into our Envoy and telling us the times our panels went off! We can do that anytime ourselves.
All in all better to put the £1375 in a savings account and if something really goes wrong with your panels you will find a local company to sort it out. The two panels on our array that are poorly performing are losing us about £60 a year in fit payments. Certainly not worth giving a company that may not even be trading anymore in a few years time £1375 to fix them.
I wonder if this open to abuse where Enphase are giving away information to companies registered to their "Eco Partner" program.
https://whois.domaintools.com/ecopartnersuk.com
EcoPartnersUk.com
2,403 days old
Created on 2016-03-08
Expires on 2024-03-08
Updated on 2021-07-14
Our Location
Eco Partners Limited
Unit 2
Royds Enterprise Park
BD6 3EW
Future Fields
Bradford
-
Well, "data clogging" is both a funny and infuriating argument.
Technically, even a mediocre product should have no problem of "cleansing itself" from that "dirty, smelly and stency data". There is no technical detail here and therefore no further aprofundation is needed.
PR side: it sounds like a scam from the partner promoted by Enphase
Commercially, as it seems Enphase is expanding manufacturing, the scam seems to be working.
The API change can not happen without Enphase making. So it looks like Enphase seeing the scam working for EcoPartners now it wants its own scam.
I'll have to look for other options then. Thanks for the warning.