Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

encrypt encryptionKey and password using AES #62

Open
Baldhor opened this issue Oct 16, 2023 · 4 comments
Open

encrypt encryptionKey and password using AES #62

Baldhor opened this issue Oct 16, 2023 · 4 comments
Assignees
Labels
enhancement New feature or request

Comments

@Baldhor
Copy link
Owner

Baldhor commented Oct 16, 2023

Current situation
The encryptionKey and password are currently stored in the driver settings.
They are stored in plain text.
The consolre.re and 'collect debug info' functions offuscate them.


That's kind of ok, but it's far from perfect!

If the user install an app with homey-api-management permission, that said app could be able to retrive the settings of all the drivers from Homey, including ip address, encryptionKey and so on ...


Registered password and encryptionKey should be encrypted using a private key. Stored, and only decrypted when needed.


The private key itself should not be saved in the github.


DISCLAIMER:
This will not protect the device from a direct and brutal attack, but it should mitigate the risk to steal the password/encryptionKey from ESPhome app.

@Baldhor Baldhor self-assigned this Oct 16, 2023
@Baldhor Baldhor added the enhancement New feature or request label Oct 16, 2023
@RoadXY
Copy link
Collaborator

RoadXY commented Oct 17, 2023

@Baldhor
Copy link
Owner Author

Baldhor commented Oct 17, 2023

Yes maybe, I just don't catch how the cipher works, and I don't like using things I don't understand :)
But it looks simple to use.

@Baldhor
Copy link
Owner Author

Baldhor commented Oct 17, 2023

Also, unsure how he retrieve the secreteKey from env.
const secretKey = Homey.env.SECRET;

@RoadXY
Copy link
Collaborator

RoadXY commented Oct 19, 2023

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants