Home Assistant blocked from integrating with Garage Door opener API

Original Article ↗ Hacker News Discussion ↗

Chamberlain Group has blocked the popular open‑source Home Assistant platform from accessing its MyQ garage door API, citing excessive traffic and even likening it to a DDoS attack. Commenters argue the real issue is a cloud‑only, data‑harvesting business model and the deliberate removal of local control options, which leaves long‑lived hardware dependent on a fragile, proprietary service. Many advocate boycotting such products, using local‑only alternatives like Zigbee, MQTT, or third‑party boards such as ratgdo, and call for regulation to curb “enshittified” IoT ecosystems that can be bricked or paywalled after purchase.

Context: MyQ–Home Assistant Breakage

  • Chamberlain/MyQ blocked Home Assistant (HA) and similar unofficial integrations by changing their cloud API and adding bot protections.
  • The HA integration was based on a reverse‑engineered, undocumented API; MyQ never formally supported third‑party local or cloud access (and discontinued its own local HomeKit bridge).
  • Chamberlain’s statement claims ~0.2% of MyQ users (via “unauthorized integrations”) were responsible for over half of all traffic and sometimes “constituted a substantial DDoS event.”

Company Rationale vs Criticism

  • Supporters of Chamberlain’s move frame it as:
    • A rational business decision: tiny user base vs cost/risk.
    • Protection of cloud resources and partnerships (e.g., Amazon Key, in‑garage delivery).
    • Aligning with a model where only vetted “partners” get API access.
  • Critics argue:
    • Calling this a “DDoS” is misleading; the issue is their own cloud‑polling design and lack of rate‑limits, webhooks, or local APIs.
    • They created the traffic problem by forcing all control/status through their servers.
    • It’s part of a broader shift to subscriptions, ads in the app, and lock‑in rather than product functionality.

Cloud-Only IoT vs Local Control

  • Many see any cloud‑required IoT device as a “trap”: breaks when servers or policies change, increases e‑waste, and exposes telemetry.
  • Others note typical consumers won’t run VPNs or HA; they want “just works” remote access, which explains cloud designs, though not pervasive data collection.

Alternatives and Workarounds

  • Popular responses:
    • Replace or bypass MyQ with local solutions: ratgdo (ESP‑based serial integration), Meross, Genie Aladdin, OpenGarage, Athom ESPHome, simple dry‑contact relays plus tilt/reed sensors, or even hacked remotes.
    • Keep MyQ only for Amazon Key while using a separate opener for HA/HomeKit.
  • Some users contact installers to stop recommending Chamberlain, expecting geeks’ advice to shift future sales.

Data Collection and Business Model

  • Commenters dissect MyQ’s privacy policy and speculate data value: occupancy patterns, car ownership, demographics, cross‑data‑broker correlation, and monetization via partners and in‑app ads.
  • Some argue the real revenue is from commercial access (e.g., retailers paying to reduce delivery fraud), not consumer analytics per se.

Policy / Regulation Ideas

  • Proposals include:
    • Mandatory local, documented APIs and open protocols.
    • Labeling for “cloud‑dependent” devices and support end‑dates.
    • Escrow and eventual open‑sourcing of firmware to mitigate e‑waste.
  • Others warn about regulatory capture and burdens on small vendors; many fall back to “vote with your wallet” and pre‑purchase research.