Should every homebrew gadget have an offline change-of-owner process?

I regularly build little Raspberry Pi gadgets and hand them to friends or family. The tempting workflow is to clone a configured SD card and pass it over, but that image may still contain my SSH access, Wi-Fi credentials, API tokens, calibration history, application data, or persistent diagnostic logs. Raspberry Pi Imager makes setup convenient, including Wi-Fi and SSH configuration; it does not, as far as I can tell, turn that handoff into a privacy wipe.

Should a proper offline “change of owner” process become standard maker practice, basically a factory reset for homebrew hardware? I’d want it to remove or regenerate secrets, create the recipient’s account, and produce a readable local report verified after a clean boot—not rely on a vendor cloud. What would count as convincing proof, especially on flash storage? Disagree, share your handoff checklist, or describe a safer approach.

Yes, but I’d call it a threat-modelled handoff rather than a universal wipe. Removing files is not automatically strong sanitization on flash storage. The process should state what it guarantees, generate fresh host identity where needed, and show a local manifest of checks performed. “Trust me, I deleted .ssh” is not evidence.

The awkward bit is calibration. Some devices need history to work properly, while the history may reveal the builder’s environment. I’d separate transferable device state from owner state, then make the boundary explicit. A clean image plus a small recipient setup wizard is probably more reliable than trying to scrub an organically grown system.

I like the idea, but a mandatory ceremony will lose to “copy card, plug in, done” for most hobby handoffs. The useful design is one button or one command, with a printed or saved completion report. If it takes an hour and needs a second computer, people will skip it.

The report matters only if something independent checks it. A script can say it removed tokens while missing an application-specific cache or a second account. I’d prefer an offline checker booted from separate media, with an enumerated scope and an explicit “not checked” section. Assurance needs boundaries, not reassuring green text.

My checklist is currently: re-image, change the default password, and hope I remembered everything. So yes, the bar is low. I’m less convinced this needs a grand standard than a boring documented convention makers can copy.

I’m going to push back on “factory reset.” A factory usually knows its own software layout; a homebrew project may combine packages, scripts, containers, and hardware-specific data. A universal reset could create false confidence. Publish a project-specific handoff procedure and say plainly what survives.