What protects you, and what can't · July 26, 2026
We tell you to buy a bare ESP32 and flash it yourself: commodity silicon, no vendor cloud. The catch: it arrives running a stranger's firmware. Here's what that costs and what to do.
The short version. Hold BOOT while you plug in a board you didn't flash yourself. Let our flasher wipe the whole chip the first time it meets it. Read what it tells you about the security fuses. And know that none of this covers a board that was physically tampered with.
Never plug an unflashed board into your computer without holding BOOT.
The chip comes up in its built-in download mode and the firmware it shipped with never runs a single instruction. That's enforced by ROM burned in at the factory, not by us.
Why this move: these chips have native USB, so their firmware decides what your computer sees. A hostile image can pose as a keyboard and type commands the instant it's plugged in, with no prompt and nothing built into Windows to stop it. In download mode the ROM presents only a serial port, so that attack is gone.
Because by the time any app or web page sees a USB device, your operating system has already set it up. Whatever the board wanted to do on plug-in has happened. Holding BOOT works earlier, inside the chip.
| Concern | Real? | What answers it |
|---|---|---|
| Types at your computer the moment you plug it in | Yes | Holding BOOT. Nothing else does. |
| Joins open Wi-Fi, shouts on the air | Yes | Holding BOOT — and it has none of your passwords yet |
| Hostile firmware survives your install | Yes | Wiping the whole chip first, which our flasher now forces |
| Flash chip is smaller than the label says | Yes | Our flasher reads both ends and compares |
| Board was locked by a previous owner | Yes | Our flasher reads the chip's security fuses and refuses it |
| Something extra soldered to the board | Yes | Nothing. No software can see a modified circuit board. |
| Survives a full wipe and hides in your Canary | No | The recovery ROM can't be written, and the device's identity key is created fresh after the wipe |
Every one of these is a read. The flasher never burns a fuse, so a flash from the page can always be redone.
The strongest signal, and free. A brand-new chip has every security fuse unset, so anything set was set by a person. If a previous owner turned on secure boot or flash encryption, the board is locked to their key for good: these fuses only burn one way. If any of the fatal ones are set, we tell you the board can't become a Canary before you waste an evening on it. If it was sold to you as new, it wasn't.
A relabeled memory chip is a common marketplace fraud: sold as 16 MB, actually 4 MB, the top of the range mirroring the bottom. We read a block from each end and compare; on a chip that arrived erased, we say the check was inconclusive instead of guessing.
We read the firmware's own name off the board. MicroPython, CircuitPython, Espressif's AT firmware, an Arduino sketch: all common, all fine. Something we don't recognize isn't an accusation, just worth a look before you erase it, and the flasher saves a copy either way.
A normal install overwrites only the parts of the chip it needs: right for a Canary you already own, wrong for a stranger's board, because anything in the parts we don't touch would survive. On a board our flasher has never seen, the full wipe is mandatory.
The browser flasher can read the security fuses. The desktop Flasher app can't: the tool it drives has no command for it. It says so on screen, because a missing check reads exactly like a passed one. Everything else on this page works the same in both.
A modified circuit board. An extra chip, a rewired USB path, a substituted module — nothing readable over a cable can see any of it. Buying from a distributor with real provenance, not a marketplace reseller, is the only answer, and a weak one.
Proving the silicon is genuine. There's no way, from your computer, to confirm a chip is really an Espressif part. A good enough clone answers every question correctly.
"Nothing looks wrong" is not "proven safe." It means the fuses are untouched, the flash is the size it claims, and the address is well-formed. That's a floor, not a guarantee, and we'd rather you hold it as one.
Once your Canary's firmware is on, you can burn the same security fuses yourself (secure boot and flash encryption), so you are the last person who can change what runs on that board. It's permanent, so it's never a default; the provisioning guide has the steps.
The full engineering write-up — every fuse we read, where the numbers come from, and each check's failure mode: unflashed_board_intake.md
How we prove our firmware matches our public source: supply-chain transparency · the provenance trail
Found a hole in any of this? security.txt
