So if I understand correctly, they used hard coded constants to generate keys that only have 44 bits of entropy, which is brute forcible for $10, but you have to do it per device. They presumably did this to make pairing the bridge and sensor easier while not using a static key for all devices. Not the worst compromise I guess.

I've been working on an open source solution on and off for a number of years called http://y-drip.com. It uses Wi-Fi so battery life is only a few months and range is limited. My next design is probably going to use LoRa, but this complicates things a lot because now I have two devices (bridge and sensor) that need to be paired, support over-the-air updates, etc.

What's the best way to have them share keys without adding expensive hardware like Bluetooth or NFC. The sensor also needs to be waterproof so there's no exposed ports. Increasing from 44 bits to 128 would help, but if the key generation is done over the air it can be sniffed right?