BlueOS icon indicating copy to clipboard operation
BlueOS copied to clipboard

core: services: wifi: don't store passwords in plaintext

Open ES-Alexander opened this issue 2 years ago • 0 comments

Wifi passwords are currently stored in plain text in /etc/wpa_supplicant/wpa_supplicant.conf when they're added by BlueOS's wifi service, which seems unnecessary, especially since the BlueOS web interface requires no password inputs to be able to access that file (so anyone with temporary access to the device could freely copy the passwords of any network the RPi has previously been connected to).

At minimum we should be using hashed keys like those created by the wpa_passphrase executable, but ideally we'd also be salting them and storing both the salt and wpa_supplicant.conf somewhere that requires authentication.

ES-Alexander avatar Jun 26 '23 03:06 ES-Alexander