home or mobile users often have dynamic IPs and thus can't be "whitelisted". Why would you not want someone on their phone access the controls?
And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.
points vaguely at the exploit and how easy it is to find the targets.
If "change it from their phone" is a requirement, they can connect the phone to shop's network, or VPN from phone to HQ then bounce to the controller.
It is security by obfuscation, yes, but it is somewhat effective at low cost.
> And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.
The controllers go out of support after some years. They work just fine, so replacing one if possible is costly and seen as unnecessary.
Putting it between $50 VPN box decouples "keeping VPN software up to date" and "keeping the controller up to date". It also gives your IT a single type of VPN config to support rather than being controller dependent.
Yes, of course use good encryption and auth{n,z}, but _also_ layer on restrictions at the network layer to stop general traffic from even getting there.
There are rarely good reasons to control domestic fridges remotely. Why would you want to trigger defrosting when you are not there?