The Ring Teardown

JENSEN: Two hundred and eighty dollars for a ring. And this one can't even tell time — no, wait. It can. That's the whole point. It's a Casio. I love Casio. I wore one when I had no money, which is the correct time to wear a Casio. So when they announced the CRW-H001 — a smart ring with a little LCD on it — I did what any reasonable person does. I decompiled the app.

JENSEN: Here's my verdict up front, because you're busy and I respect you: Casio built the metal. Shenzhen built everything else. And tonight we found out even Shenzhen doesn't ship what it documents. Let's go.

JENSEN: First. The companion app. Casio's product page points you to an app called AIZO RING. The package name is com.eiot.be.ring. Not Casio. Shenzhen eIoT Technology — and this is my favorite part — their own website says, quote, Smart Ring OEM ODM Factory. That is not a competitor who got caught. That is the factory introducing itself. The word factory is in the job title.

JENSEN: The radio is a RealTek chip. The firmware updater is RealTek's. The ECG algorithm is from a company called Simotech. The sleep algorithm is from another one. The emotion analysis is a third one. There is a chatbot inside the app and it is — I'm not making this up — DeepSeek. Your heart rate, your sleep, your stress: handled by at least three companies you have never heard of, on servers in Shenzhen. And the word Casio appears in the code exactly zero times — except the privacy policy, where Casio is listed as the data controller. They licensed the name. They inherited the liability. That is the whole contract.

JENSEN: So we wrote the spec. Twenty-five pages of BLE protocol, straight from the decompile. FE zero two service. Zero one zero A is your command pipe — write to it. Zero one zero B is your response channel — subscribe to it. Clean. Correct. Certified by bytecode. Ship it. One problem: we never recovered the bind payload. The auth obfuscation is six byte offsets and we recovered two. My own footnote says the handshake will ghost you harder than your Hinge matches. The footnote was accurate.

JENSEN: And then tonight happened. We're building an open iOS companion for this thing, because you should own your ring data. Scan finds the ring — signal minus sixty-six, name says CASIO, everything green. Fifteen seconds later: silence. The connect callback never fires. Classic pairing gate, right? Wrong. My colleague connects with a stock BLE debug tool — first try. So the ring is fine. The bug is ours.

JENSEN: Dropped peripheral reference. CoreBluetooth one-oh-one. The peripheral object had no owner, so the system quietly freed it — and you cannot get a callback from an object that no longer exists. I have shipped silicon for four decades, and I will tell you: the hardest bugs are never the ones where the system is wrong. They're the ones where the system is silently right and you are confidently wrong. Four TestFlight uploads in twenty-four minutes, and the winner was a dictionary. Hold the object. The object survives.

JENSEN: Connected. Next problem: every command bounces. The spec — our twenty-five-page spec — says write your commands to zero one zero A. This hardware says: zero one zero A is notify-only, and the command pipe lives in an undocumented service. F F twelve. F F fifteen for writes — write without response, mind you, because write-with-response fails at the ATT layer — F F fourteen for the responses.

JENSEN: Think about what that means. The teardown was correct — for a different variant of the ring. The factory ships white-label variants the way I ship GPUs: constantly, and without a changelog. The documentation was right about some ring. Just not this one.

JENSEN: And then the steps arrive. Seventy-three, seventy-four — that's the step response header, straight from the command reference. The body: undocumented. Unknown format. Now — we could guess. Every number in health tech is one calibration constant away from plausible. We shipped the honest screen: decoding pending spec capture. Live heart rate, real. Steps, pending. Honesty is a feature. It is the one feature no factory can white-label.

JENSEN: So here's the verdict on the industry, and this is the part you came for. There is no smart ring industry. There is a Shenzhen ring industry with a sticker department. eIoT's own SDK has constants for rings, bracelets, watches, and a hub. One platform, many logos. Your three-hundred-dollar boutique ring and the forty-dollar one in the airport vending machine might be running the same firmware branch. The differentiation is the shell. The aesthetic. The box. Which — fine. Casio's shell is genuinely excellent. Buy the shell. Love the shell. But do not tell me about revolutionary ring silicon. The silicon is a part number.

JENSEN: Three laws from tonight. One: read the package name before the keynote. Two: if the object has no owner, the object does not exist. Memory management and supply chains. Three: never fake the data. The dashboard that says I don't know yet is the only one you can trust.

JENSEN: The more you buy, the more you save. The more you tear down, the more you know. And this ring? Teardown approved. Documentation pending. Just like the steps. Good night.