What protects you, and what can't · July 26, 2026
We tell people to buy a bare ESP32 board and flash it themselves. That's a real advantage — commodity silicon, no vendor cloud, nothing sealed shut. It also means the board turns up carrying somebody else's firmware, from a seller nobody vetted. Here's the honest account of what that costs you and what to do about it.
The obvious idea is that you should open our app before plugging the board in, and the app stands guard. It can't, and we won't pretend otherwise.
USB works from the bottom up. By the time a web page or an app learns that a device exists, your operating system has already talked to it, accepted whatever it claimed to be, and finished setting it up. In a browser you then have to pick the device from a chooser, which is later still. Anything the board wanted to do on plug-in has already happened.
So an app that promised to shield the moment of plugging in would be selling you a feeling. What we ship instead is the instruction that genuinely works — and it's better than an app, because the chip itself enforces it.
Never plug an unflashed board into your computer without holding BOOT.
The chip comes up in its built-in download mode and the firmware it shipped with never runs a single instruction. That isn't a promise we're making — it's unerasable ROM burned into the chip at the factory, the same property that makes these boards impossible to ruin from our flasher.
Here's why that specific move, and not something vaguer. These chips have native USB, which means the firmware on them decides what kind of device your computer sees. A hostile image can come up as a keyboard and start typing commands at your desktop the instant the cable goes in. There's no prompt, and on Windows there's nothing built in to stop it.
Held in download mode, the chip can only ever be a serial port — the descriptor is fixed in ROM, and none of the vendor's code is running to ask for anything else. One gesture, whole category of attack gone.
| Concern | Real? | What answers it |
|---|---|---|
| Types at your computer the moment you plug it in | Yes | Holding BOOT. Nothing else does. |
| Joins open Wi-Fi, shouts on the air | Yes | Holding BOOT — and it has none of your passwords yet |
| Hostile firmware survives your install | Yes | Wiping the whole chip first, which our flasher now forces |
| Flash chip is smaller than the label says | Yes | Our flasher reads both ends and compares |
| Board was locked by a previous owner | Yes | Our flasher reads the chip's security fuses and refuses it |
| Something extra soldered to the board | Yes | Nothing. No software can see a modified circuit board. |
| Survives a full wipe and hides in your Canary | No | The recovery ROM can't be written, and the device's identity key is created fresh after the wipe |
Every one of these is a read. The flasher never burns a fuse — that's what makes it impossible to ruin a board from the page.
This is the strongest signal there is, and it's free. A brand-new chip has every security fuse unset, so anything set was set by a person. If a previous owner turned on secure boot or flash encryption, that board is locked to their key forever — these fuses only burn one way, and nothing can undo them. We read them, and if any of the fatal ones are set we tell you the board can't become a Canary rather than letting you waste an evening on it. If it was sold to you as new, it wasn't.
A relabelled memory chip is a common marketplace fraud: sold as 16 MB, actually 4 MB, with the top of the range quietly mirroring the bottom. We read a block from each end and compare. On a chip that arrived erased there's nothing to compare, so we say the check was inconclusive instead of guessing.
We read the firmware's own name off the board. MicroPython, CircuitPython, Espressif's AT firmware, an Arduino sketch — all common, all fine. Something we don't recognize isn't an accusation; plenty of honest sellers ship their own demo. It's just worth a look before you erase it, and the flasher saves a copy either way.
This one changed because of writing this page. A normal firmware install only overwrites the parts of the chip it needs, which is right for a Canary you already own — and wrong for a board that arrived carrying a stranger's software, because anything in the parts we don't touch would survive. On a board our flasher has never seen, the full wipe is now mandatory and you can't switch it off.
The browser flasher can read the security fuses. The desktop Flasher app can't — the tool it drives underneath has no command for it. We'd rather say so than quietly skip a check, because a missing check reads exactly like a passed one. The desktop app tells you this on screen, and everything else on this page works the same in both.
A modified circuit board. An extra chip, a rewired USB path, a substituted module — nothing readable over a cable can see any of it. Buying from a distributor with real provenance rather than a marketplace reseller helps, and it's a weak answer, but it's the only one.
Proving the silicon is genuine. There's no way, from your computer, to confirm a chip is really an Espressif part. A good enough clone answers every question correctly.
"Nothing looks wrong" is not "proven safe." It means the fuses are untouched, the flash is the size it claims, and the address is well-formed. That's a floor, not a guarantee, and we'd rather you hold it as one.
Once your Canary's firmware is on, you can burn the same security fuses yourself — secure boot and flash encryption — so that you are the last person who can ever change what runs on that board. It's permanent and there's no way back, so it's never a default and never automatic. If you want it, it's documented in the provisioning guide.
The short version. Hold BOOT while you plug in a board you didn't flash yourself. Let our flasher wipe the whole chip the first time it meets it. Read what it tells you about the security fuses. And know that the one thing none of this covers is the board itself having been physically tampered with — which is exactly why we'd rather write this page than a reassuring one.
The full engineering write-up — every fuse we read, where the numbers come from, and each check's failure mode: unflashed_board_intake.md
How we prove our firmware matches our public source: supply-chain transparency · verify a download
Found a hole in any of this? security.txt