TLDR: the &quot;authenticate&quot; HTTP call on my heating system is optional, so you can change the temperature without the PIN.<p>For one example, I recently moved into a newly refurbished apartment.  It has underfloor heating, with a central control box and remote sensors&#x2F;controllers in each room. [1] It cost something like €1500-€2500, plus installation, plus the pipes etc.<p>The central control box has an ethernet port and MicroSD slot, which takes a ZIP downloaded from the manufacturer&#x27;s site.<p>I set this up, and was disappointed to see just how terrible the provided software is.  There&#x27;s no Android app, and the iPhone app costs a further €15 [2].  It has only the most basic functionality: see and change the target temperature in a room, and change which program runs (day&#x2F;night&#x2F;off&#x2F;preset1&#x2F;2&#x2F;3).  The most-needed thing — to change the preset timings without 100 presses of a 5-button LCD interface — isn&#x27;t possible.<p>The web interface is the iPhone app implemented as a Java applet making HTTP calls to the server.  It&#x27;s too big to fit on my laptop&#x27;s screen. There&#x27;s an &#x27;authenticate&#x27; call, but it&#x27;s optional — the app requires using it, and the call gives the correct pass&#x2F;fail response, but there&#x27;s no session handling so there&#x27;s no need to make this call before reading or changing temperatures.<p>The Java applet at least means it&#x27;s not easy to do a Google search for the web interface, but I just found this site [3].  There are a few results, but from a long time ago.<p>[1] <a href="http:&#x2F;&#x2F;www.billigvvs.dk&#x2F;Varmesystemer-Gulvvarme-Roth-gulvarme-varianter--Roth-Komplet-Traadloes-Gulvvarmestyring-inkl-Pumpe-4-Kredse-611638.html" rel="nofollow">http:&#x2F;&#x2F;www.billigvvs.dk&#x2F;Varmesystemer-Gulvvarme-Roth-gulvarm...</a><p>[2] <a href="https:&#x2F;&#x2F;itunes.apple.com&#x2F;dk&#x2F;app&#x2F;roth-touchline&#x2F;id498448526?mt=8" rel="nofollow">https:&#x2F;&#x2F;itunes.apple.com&#x2F;dk&#x2F;app&#x2F;roth-touchline&#x2F;id498448526?m...</a><p>[3] <a href="http:&#x2F;&#x2F;www.base64online.com&#x2F;hc.php" rel="nofollow">http:&#x2F;&#x2F;www.base64online.com&#x2F;hc.php</a>