Python client for the $20 Colmi R02 smart ring

So you just scan for devices and then read? There's no authorization involved, these just publish the readings wirelessly for all interested?

The ring has a very minimal interface. Apart from the sensors - an accelerometer to count steps and two LEDs with photodiode to get heart rate and blood oxygen - there is one status LED on the inside to indicating charging. That's it. The ring is a pure data collection device that basically can't be interacted with without the app.

Maybe they could have required you to hit the ring on a surface to initiate pairing mode. But as it stands the ring will pair with any device that asks for it.

I'm looking forward to someone making a custom firmware for these rings. There is some work in the linked ATC_RF03 project, but I'm not sure if anyone is still working on it

The basically-no-authorisation arrangement is somewhat common for modern bluetooth devices.

It's problematic for things like keyboards used for entering passwords - but if my next door neighbour wants to snoop on my living room thermometer or someone wants to snoop on my heart rate strap as I jog past their house? It doesn't seem to be much of a problem, in practice.

In the bad old days of bluetooth, loads of devices without screens would just hard code the pairing code to 000000 anyway. So it wasn't adding much security anyway. Unlike internet-connected devices, it's not exposed to a billion griefers from around the globe at any given moment.

Ongoing read of your neighbours, roommates, co-workers etc health data from a distance including recent history is getting your hands on sensitive personal data in addition to health data. You can tell what they are doing, getting drunk or having sex etc.

I started looking at this last night [1] since there's an open SDK available (called SDK3) [2] but it seems like keil is involved in compiling it and I'm out of my depth when it comes to embedded stuff at the moment

1. https://notes.tahnok.ca/blog/Smart+Ring+Reversing/2024-10-13... 2. https://gitee.com/BXMicro/SDK3

... doesn't the app set an encryption key after they pair?

The most similar device I've worked on is the various Oculus devices. Which will also accept bluetooth connections from absolutely everyone, but the first time you connect you store an encryption key that is used to secure all subsequent comms.

If it did that then losing your phone, deleting the app's storage or moving to a different phone without transferring the app's storage would brick the smart ring.

Oculus decides are pretty big, I assume they have buttons that allow you to recover from that. This ring doesn't.

I mean, they have at least one button to trigger a factory reset, yeah.

Even most input-less smart devices have a way to do that though - like those ridiculous smartlight bulbs where you have to flick the light switch on and off in morse code to trigger the factory reset