Dept. of Accidental Investigations — How I upgraded my water heater and discovered how bad smart home security can be Could you really control someone’s hot water with just an email address?

Kevin Purdy – May 17, 2024 11:00 am UTC Enlarge / This is essentially the kind of water heater the author has hooked up, minus the Wi-Fi module that led him down a rabbit hole. Also, not 140-degrees Fyikes.Getty Images reader comments 279

The hot water took too long to come out of the tap. That is what I was trying to solve. I did not intend to discover that, for a while there, water heaters like mine may have been open to anybody. That, with some API tinkering and an email address, a bad actor could possibly set its temperature or make it run constantly. Thats just how it happened.

Lets take a step back. My wife and I moved into a new home last year. It had a Rinnai tankless water heater tucked into a utility closet in the garage. The builder and home inspector didn’t say much about it, just to run a yearly cleaning cycle on it.

Because it doesnt keep a big tank of water heated and ready to be delivered to any house tap, tankless water heaters save energyup to 34 percent, according to the Department of Energy. But they’re also, by default, slower. Opening a tap triggers the exchanger, heats up the water (with natural gas, in my case), and the device has to push it through the line to where it’s needed.

That led to me routinely holding my hand under cold water in the sink or shower, waiting longer than felt right for reasonably warm water to appear. I understood the water-for-energy trade-off I was making. But the setup wasted time, in addition to potable water, however plentiful and relatively cheap it was. It just irked me. Advertisement

Little did I know the solution was just around the corner. Hot water hotspot Attention! Kevin Purdy Nothing’ll happen. Just touch it. It’s what you wanna do. It’s there for you to touch. Kevin Purdy The Rinnai Central app. It does this “Control failed” bit quite often. Rinnai

I mean that literally. When I went into the utility closet to shut off the hose bibbs for winter, I noticed a plastic bag magnetically stuck to the back side of the water heater. Attention! The Control-R Wi-Fi Module must be installed for recirculation to operate, read the intense yellow warning label. The water heater would not “recirculate” without it, it noted.

Enlarge / The Rinnai Control-R module, out of bag.RinnaiRecirculation means that the heater would start pulling water and heating it on demand, rather than waiting for enough negative pressure from the pipes. To trigger this, Rinnai offered smartphone apps that could connect through its servers to the module.

I found the manual, unplugged the water heater, and opened it up. The tone of the language inside (DO NOT TOUCH, unless you are a properly trained technician) did not match that of the can-do manual (get the most from your new module). But, having read the manual and slotted little beige nubs before, I felt trained and technical. I installed the device, went through the typical Connect your phone to this weirdly named hotspot process, andit worked.

I now had an app that could start recirculation. I could get my shower hot while still in bed, or get started on the dinner dishes from the couch. And yet pulling out my phone whenever I wanted hot water felt like trading one inconvenience for another. Page: 1 2 3 4 5 Next → reader comments 279 Kevin Purdy Kevin is a senior technology reporter at Ars Technica, covering a variety of technology topics and reviewing products. He started his writing career as a newspaper reporter, covering business, crime, and other topics. He has written about technology and computing for more than 15 years. Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars