BlueOS
BlueOS copied to clipboard
core: services: wifi: don't store passwords in plaintext
Wifi passwords are currently stored in plain text in /etc/wpa_supplicant/wpa_supplicant.conf when they're added by BlueOS's wifi service, which seems unnecessary, especially since the BlueOS web interface requires no password inputs to be able to access that file (so anyone with temporary access to the device could freely copy the passwords of any network the RPi has previously been connected to).
At minimum we should be using hashed keys like those created by the wpa_passphrase executable, but ideally we'd also be salting them and storing both the salt and wpa_supplicant.conf somewhere that requires authentication.