Skip to content
HearingTracker
Log in

Fitting Authorization In Target 12.0 necessary for EONs?

25 replies275 viewsLast reply

Jump
Link to this topic
Reply
Edited

On Phonak's website describing Target 12.0 new features it says

"Fitting Authorization

An additional security layer has been introduced with EON hearing aids. Fitting Authorization can be performed automatically, or manually. If manual authorization is needed, Target will guide you through the process.

An additional security layer has been introduced with EON hearing aids. Fitting Authorization can be performed automatically, or manually. If manual authorization is needed, Target will guide you through the process."

Does anyone know what this actually means for us DIYers ? On the face of it - does it mean only recognized audiologists can do the fitting for EONs - if so then that sucks....

7 people in this conversation11 min readJump to latest

Yeah, I saw that too. It would certainly be good either way to know in advance. I for one would not buy any more Phonak hearing aids if that is the case.

This is from Google

T"his message means that Phonak has added a new security feature to protect their EON hearing aids from unauthorized programming or tampering.

When a hearing care professional connects these hearing aids to Phonak Target (the fitting software), the system requires a security check or "Fitting Authorization" to confirm they are allowed to adjust the devices.

Here is a breakdown of how it works:

The Security Layer: This prevents just anyone with the software from altering the hearing aid settings, ensuring patient safety and device security.

Automatic Authorization: In most cases, the software will seamlessly verify the connection over the internet behind the scenes. You won't have to do anything.

Manual Authorization: If the automatic check fails—usually due to an intermittent internet connection or firewall restrictions—the software will provide step-by-step instructions. This typically involves entering a specific code or performing a manual verification step to unlock the hearing aids for programming."

If the AI is correct then it seems the new fitting software will be locking down the settings and we will not be able to do our own programming an more.

In my opinion, eventually it will be a simple programming change when the aid is manufactured to make the hearing aids programmable only by someone authorized by Phonak is using their software, locking everyone else out.

I don't think this is how it's gonna work, first why would they even bother? obviously not for the 0.1% of us into ? some people live/work all over the country/world at any given time, it would definitely disadvantage customers who use their products,this would be like all those oddball rebranded models and Specsavers, why would a need "device security" for whatever that means,or permission to adjust? This is a rabbit hole as the HAs belong to the enduser, we'll need to confirm as a few people have already started their DIY in EON so hopefully they can, but yeah so this cloud based programming from Widex plus eBay refusing to list HAs for sale, and now this! it's not looking good at all for DIY, this is obviously designed to keep prices high as possible, 5,6,8k HAs will be back as normal/standard ☹️

The Fitting Guide adds a little more info -

"Fitting Authorization

Fitting authorization provides an additional level of security through Target. These recommendations were defined by the EHIMA – cybersecurity working group; a group of representatives from the major hearing aid manufacturers.

The authorization happens automatically when the fitter is logged into a /PhonakPro account or they are using NOAHLink wireless 2 as their fitting device. If it cannot be done automatically then it can be done manually in Target. It only needs to be done once for a first fitting with EON devices. Subsequent connections to Target within that client’s session do not need to be reauthorized. Guidance to perform the fitting authorization is provided during the Connection workflow in Target 12."

It is probably likely this EHIMA cybersecurity group recommendation will also start appearing in other programming software since it is sponsored by other major hearing aid manufacturers? (Oticon Genie 2 etc)

Interesting it also states "NOAHLink wireless 2" and not the older version. Of course, this could just be sloppy manual writing....

Perhaps one could persuade the initial fitting audiologist to give you the actual exported session data file - which can be loaded in your own Target installation? However I doubt that the audiologist will be happy to do this - since it will be linked to his/her account with Phonak.

I see in another thread that @hearingMac seems to be programming his EONs. Perhaps all my concerns are not valid and the Phonak manual statements are misleading - or he has overcome them somehow. Hopefully he can comment on this?

In reply to @Hooby

Yes, I'm programming my own EON Sphere E90-Rs in Target 12.0.1 and Fitting Authorization has not prevented me from doing so.

I think the important part of the Target 12 manual is the manual authorization method. It says that if automatic authorization isn't available, authorization can be performed by pressing and holding the button on each hearing aid for 8 seconds. So this does not appear to require an /PhonakPro account in every case. Once authorized, Target stores the security association for that patient record and those hearing aids.

So based both on the manual and my own experience, I don't think EON has locked users out.

I've done some reverse engineering of Target 12 and this feature seems to be designed to stop bad actors from breaking into your hearing aids in public.

Theoretically with the old models, you could turn them on to put in your ears, and someone nearby could pretend to be Target and flash a correction curve designed to hurt your residual hearing.

Now, Target sends a one-off challenge off to Phonak's servers, or the Noahlink signs it with its own key, or the aids present a response themselves by holding the button for 8 seconds. When reconnecting, Target presents that response back to the aids.

There's probably some limit to the number of authorizations the device holds, I'd imagine it just evicts old ones in that case.

I was worried it was designed around "locking" the aids to a specific install of Target but it doesn't seem like that's the case. I get my EONs next week and will experiment myself to verify this behaviour.

this feature seems to be designed to stop bad actors from breaking into your hearing aids in public.

Uh, like never has it actually happened anywhere.

Theoretically with the old models, you could turn them on to put in your ears, and someone nearby could pretend to be Target and flash a correction curve designed to hurt your residual hearing.

Say what, like never ever has it happened, no I don't think it's got anything to do with this theory, should be interesting to see what you come up with.

Got my EONs yesterday and configured by my audiologist, and connecting to my copy of Target today felt no different to the Infinio. No auth popup or anything, it just connected fine as it always has. Guess the Noahlink authorization is transparent to the user!

I also found the EHCI whitepaper1 about the new security measures.

There is some room for interpretation, but to me it reads like cyber-security in service of user safety. A quote:

Hearing device vendors need to ensure – with a reasonable level of trust – that only professional can access and modify the fitting settings in hearing devices. Loss or degradation of integrity of the fitting settings in a hearing device may result in harm by using such a device.

If you're uncharitable, it definitely reads as "lock down to HCPs to assert control" but the actual implementation in Target goes against that logic, so I'm giving them the benefit of the doubt.

Hearing device vendors need to ensure – with a reasonable level of trust

This part is the best,so they actually have no way of implementing it without actually "knowing who to trust" so I guess they'll just go by gut feeling for now, I cannot see this as working, the whole thing just make's no sense in the long run.

In reply to @mon

Interesting - I also got my EONs yesterday and configured by my audiologist, and connecting to my copy of Target today. The first thing it did was to prompt me to hold the button on each aid for 8 seconds for authorization. After that Target worked as usual. All I did was save the configuration the audi had made - so no changes were made (yet...).

I am going back to her tomorrow for a simple change - so it will be interesting to see whether her Target will have to re-authorize or whatever. Perhaps both of our Targets are now authorized - that would be the best scenario, but surely that would not fit with your quote from the whitepaper regarding "trust".

You wouldn't think that would make any difference,as they both do exactly the same thing, only real difference is the Bluetooth chip version.

It was directed at you. How odd! I'll have to dig further to understand when it asks for the 8 second long hold, vs doing things automatically.

But it works, so maybe not worth the effort :)

Update - I went to the audiologist for a slight adjustment yesterday. She had to re-authorize the Eons. I think she was a little puzzled by this but did not say anything. This morning I connected to Target and sure enough it said the my authorization was no longer valid and to retry by turning them off and reconnecting. That worked fine.

So it seems that only one authorization is allowed - but it is easy to re-authorize. The Audiologist will always know if you have connected to Target at home - even if you make no changes. This will only be an issue if the audiologist objects to you using Target yourself - some do and some don't it seems.

So in view of the quote that @mon found - I can't see how it achieves the goal of only allowing "professional " to make changes. It looks more like anyone at all who has Target and Noahlink can do it. So it is good for DIYers but might be contentious if you also need help from your audiologist.

@mon said:

Hearing device vendors need to ensure – with a reasonable level of trust – that only professional HCPs can access and modify the fitting settings in hearing devices. Loss or degradation of integrity of the fitting settings in a hearing device may result in harm by using such a device.

Note- I also asked the audi to do a remote session after I authorized the Eons the first time. We were unable to open a session - it just said it was trying to connect and never doing so. She just thought that the remote sessions were sometimes flakey and was not surprised - which was why I went in person yesterday. I suspect it was actually because she was no longer authorized !

Very interesting. I have one more theory! What version is the firmware on your NoahLink? Mine is 3.27. Perhaps it needs to be newer than a certain version.

Also @tenkan

You wouldn't think that would make any difference,as they both do exactly the same thing, only real difference is the Bluetooth chip version.

Target actually explicitly only enables the authorization feature for the NLW2, it seems if you have a NLW1 you will always have to do the button press. From decompiled Target libs:

public NoahLinkWireless(...) {
	RegisterFeatures(deviceDiscoveryFeature, sessionKeyFdFeature, txPowerNlwFeature, ledFdFeature, _powerManagementFdFeature, noahLinkWirelessAvailabilityFeature);

vs

public NoahLinkWireless2(...) {
	RegisterFeatures(deviceDiscoveryFeature, sessionKeyFdFeature, txPowerNlw2Feature, ledFdFeature, powerManagementFdFeature, noahLinkWirelessAvailabilityFeature, authorizationFeature);

Note the last argument, authorizationFeature . And there is only a single version of that class, that being Nlw2AuthorizationFeature .

Related discussions