Possible documentation Update

[bwosborne2]

I just noticed this change in the Z-Wave specification for door locks that inserts a confirmation dialog box during inclusion if low security is selected.
Perhaps some documentation changes are needed either here or in zwavejs2mqtt.

https://community.silabs.com/s/share/a5U1M000000knqNUAQ/updated-your-zwave-smart-locks-are-safe-and-secure?language=en_US

https://nvd.nist.gov/vuln/detail/CVE-2018-25029

https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/

Just trying to keep my eyes open to improve the user experience...

[AlCalzone]

To be sure, you're talking about this?

We are updating the specification to ensure that any user will not only get a warning during a downgrade to S0 but will have to acknowledge the warning and accept it to continue inclusion.

[AlCalzone]

So, essentially the user has to be notified when
a) QR code inclusion is used (implies S2 and/or SmartStart), but S2 is then missing from the supported CCs
b) A node is included with S0, the user didn't choose S0 and the device later claims to support S2

[bwosborne2]

That should work. I get a weekly report of CVEs from the US government & saw this one. I wanted to insure users were ware.