How do we disable remote access with the new Sonos web app?

I also want to turn remote web access off please.  There is no reason for anyone who is not on my network to control my system. 

Two types of access you need to look at blocking, from the speakers/device and from the Controller App. Figuring out what you can block without breaking anything is going to be time consuming. Figuring out what you can block that breaks stuff you don’t use a bit more time.

Easy way is add a filter to your firewall to tag all data from the device you are looking at. Then go in and block one stream at a time and note what works/breaks. Once done you might set up several rules: Block all Sonos, Block as much as possible but allowing essential features to work, Block non-essential features that you don’t need every day.

I’m still in the ‘Hope things get better soon.” camp so I won’t be working on this or tweaking my DNS block-lists unless I notice them breaking anything I need.

Without your password they can't login.

Password only security for remote control of every Sonos speaker in the world is poor. If Sonos test their internal security as well as their apps then we’re screwed.

2FA is a must at minimum.

Assuming they are trying to log on and not exploiting a security flaw they have discovered.

I haven’t looked at the password requirements, does Sonos enforce a long, random password or does it let you use something easily guessable?

This is pretty bad  

• At least 8 characters.
• No common passwords.
• Previously used passwords can't be reused.

THIS is the correct take. While I am all about strong passwords (and MFA), the greater concern is a threat actor exploiting a vulnerability in the Sonos back end that we’re all forced to interact with now. And at the risk of stating the obvious, I put zero faith in this crew having their act together on security.

“Previously used passwords can't be reused.”

Let's hope they’re not storing passwords unencrypted 😮

Thanks for pointing out the Web App. I disables access to the internet for my SONOS speaker in my router (AVM Fritzbox). The WebApp now complains about the speakers not being connected. I like that very much.

I do agree, that security to the web app is awful. No MFA or any other up to date authentication mechanisms. No transparency what API`s my local SONOS speakers expose. No 3rd party security test or attestations for the SONOS boxes. So I have to assume worst case, that attackers could hijack my local hardware and I have no way to defend against it.

What makes me wonder even more is the GDPR compliance. Not sure what features of the SONOS boxed would still work, if I refuse (working on that) to accept their data privacy policy. Puts SONOS in an awkward position, customers buying expensive SONOS boxes in a retail store just to find out they can not make them work without exposing their personal data outside of the GDPR compliant governance space. GDPR = European data protection law.

The cloud API exposed by your system is described here: https://docs.sonos.com/docs/control-sonos-players - however I know for a fact of APIs not described there, so consider it a subset.

You do have to give permission for any 3rd party to use this API on your system, via “login with Sonos”, the UX that Sonos themselves do not use in their web app.