IoT technology and smart home

Also, in the firmware code, it is possible to issue true access to MYEWWT to other users - just select the "Add user" menu in the settings and specify its ID.

Summing up, we can conclude that such a connection is safe. In order to have unauthorized access to the bot, you will have to gain access to the MYEWWT owner's account, which is quite difficult to do, and with the proper Telegram profile security settings, it is almost impossible.

Inside the home, other devices such as sockets, relays, switches, etc. not connected to Wi-Fi and not connected to the Internet (except for attempts to contact the server to update the firmware once every n hours)

Communication between MYEWWT and other devices is transmitted using ESP-NOW, a data transfer method built into the Espressif SDK. This connection is peer-to-peer, does not require a time-consuming "handshake" and is also provided with the possibility of using the CCMP protocol, the AES-128 algorithm. Communication between devices is established by sending a packet to the MAC address of the device, or using a broadcast.

Server-MYEWW connection and smart home (Internet of things)

All aspects of the security of the Telegram API itself, namely profile protection, chat protection, etc. described here.

A connection is established between the Telegram servers and MYEWWT via a secure communication channel, this is guaranteed by the SSL protocol, the Telegram servers themselves do not allow you to connect and receive a request from the bot without using SSL encryption.

In the firmware code, thanks to BearSSL (an implementation of the SSL protocol in the C language), a client is created with which we are able to receive and send requests to the Telegram API, specifically to the bot specified in the firmware (when configuring MYEWWT).

To prevent another user who received a link to a bot running MYEWWT or found it in the search to access it, a white list is created in the firmware code, where the user IDs are located. ID is a unique account number in Telegram, it cannot be faked or changed. Thus, when setting up MYEWWT, the first person who accesses the bot gets access, his ID is stored in non-volatile memory, and the ability to exchange messages is assigned to this user, messages from other users are simply filtered out.