bluerobotics / bluerobotics/BlueOS
core: services: wifi: don't store passwords in plaintext
- Dominant language
- Vue
- Stars
- 453
- Forks
- 151
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 174
Description
Wifi passwords are currently stored in plain text in `/etc/wpa_supplicant/wpa_supplicant.conf` when they're added by BlueOS's wifi service, which seems unnecessary, especially since the BlueOS web interface requires no password inputs to be able to access that file (so anyone with temporary access to the device could freely copy the passwords of any network the RPi has previously been connected to).
At minimum we should be using hashed keys like those created by the `wpa_passphrase` executable, but ideally we'd also be salting them and storing both the salt and `wpa_supplicant.conf` somewhere that requires authentication.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing BlueOS's wifi service to the code that writes /etc/wpa_supplicant/wpa_supplicant.conf, then compare its handling with the output of wpa_passphrase. Clarify whether hashed keys alone or authenticated, salted storage is required before changing behavior. Done means previously connected network passwords are no longer stored in plaintext and access to the stored configuration is protected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- raspberry-pi
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100