You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Current situation
The encryptionKey and password are currently stored in the driver settings.
They are stored in plain text.
The consolre.re and 'collect debug info' functions offuscate them.
That's kind of ok, but it's far from perfect!
If the user install an app with homey-api-management permission, that said app could be able to retrive the settings of all the drivers from Homey, including ip address, encryptionKey and so on ...
Registered password and encryptionKey should be encrypted using a private key. Stored, and only decrypted when needed.
The private key itself should not be saved in the github.
DISCLAIMER:
This will not protect the device from a direct and brutal attack, but it should mitigate the risk to steal the password/encryptionKey from ESPhome app.
The text was updated successfully, but these errors were encountered:
Current situation
The encryptionKey and password are currently stored in the driver settings.
They are stored in plain text.
The consolre.re and 'collect debug info' functions offuscate them.
If the user install an app with homey-api-management permission, that said app could be able to retrive the settings of all the drivers from Homey, including ip address, encryptionKey and so on ...
Registered password and encryptionKey should be encrypted using a private key. Stored, and only decrypted when needed.
The private key itself should not be saved in the github.
DISCLAIMER:
This will not protect the device from a direct and brutal attack, but it should mitigate the risk to steal the password/encryptionKey from ESPhome app.
The text was updated successfully, but these errors were encountered: