Best Practice for storing secured data like password in plugins ?

Plugins & Plugin Development General Plugin Discussion
1

in my plug in I need to store a password. I do use JS tab and a in type=password mode but the clear text is then stored as a variable of the device.

Is there some recommended method or best practice for storing secure data like password and obfuscating it a little bit from simple user eyes ? is there a way to encrypt ? does vera have a key for encrypt/decrypt?

2

Unfortunately no. This was discusses a few times in the forum. I’ll have to try and find the links. But there is no way to secure the password in the plugin. Is the password settable?

  • Garrett
3

[quote=“garrettwp, post:2, topic:177442”]Unfortunately no. This was discusses a few times in the forum. I’ll have to try and find the links. But there is no way to secure the password in the plugin. Is the password settable?

  • Garrett[/quote]

the password is the person 's iCloud password and he has to enter it in the plugin configuration variables…

4

There are all kinds of passwords stored in Vera … if you have passwords on any cameras they are stored there. If you allow Vera to disarm your alarm system … the code is stored …

That’s why there is a security risk if you allow inadvertent access of your Vera to others or the Internet.

There must be some encryption libraries on Vera … since MCV allows encryption of APPS.
MCV does the encryption (optionally) when a developer stores an unencrypted filed in the APP store … and the LuaUPnP program has the key to deencrypt the files when Vera needs them. I have never looked to see what they use.

5

[quote=“amg0, post:3, topic:177442”][quote=“garrettwp, post:2, topic:177442”]Unfortunately no. This was discusses a few times in the forum. I’ll have to try and find the links. But there is no way to secure the password in the plugin. Is the password settable?

  • Garrett[/quote]

the password is the person 's iCloud password and he has to enter it in the plugin configuration variables…[/quote]

If you distribute an encrypted Lua module (like a “L_MypluginPassword.luaenc” in your plugin distribution) that contains nothing more than a private key and functions to encrypt and decrypt (and a lot of fluff at the top of the file so whatever logging leak in Vera won’t dump the key for debug reasons), then you ought to be able to encrypt their password with your private key for storage, and decrypt it for transmission over SSL to Apple. It’s some tedious work to set this all up, but if you have to handle the user’s iCloud password, you will definitely want to go to great lengths to not store it as plain text.

watou

6

[quote=“watou, post:5, topic:177442”]If you distribute an encrypted Lua module (like a “L_MypluginPassword.luaenc” in your plugin distribution) that contains nothing more than a private key and functions to encrypt and decrypt (and a lot of fluff at the top of the file so whatever logging leak in Vera won’t dump the key for debug reasons), then you ought to be able to encrypt their password with your private key for storage, and decrypt it for transmission over SSL to Apple. It’s some tedious work to set this all up, but if you have to handle the user’s iCloud password, you will definitely want to go to great lengths to not store it as plain text.

watou[/quote]

Thank you. i tried just that, created a special module called L_PhoneEnc.lua and published it using the encryption checkbox in the app store. When I install the plugin from the store, it does install it and is not readable by the user even if he downloads the file. so it sounds like a great option

Now all I miss maybe is a bit of Lua code that does a encrypt/decrypt and maybe a key that would be unique to this vera setbox. does this exist ? anybody has some piece of code like that ?

7

Each Vera has a hardware key which you can get from the nvram command:

nvram get vera_hw_key

This key is persistent across reboots.

Don’t go to too much trouble with encrypting the password. Anything you can do, a malicious plugin can do. If you provide encode/decode functions in L_PhoneEnc.Lua then a malicious program can just call those. Like all DRM, you aren’t “protecting” anything, just making it more inconvenient to get to.

8

You can also use this uri to get the hardware key - so not particularly secure either:

http://VERA_IP_ADDRESS/cgi-bin/cmh/sysinfo.sh

9

Each Vera has a hardware key which you can get from the nvram command:

nvram get vera_hw_key

This key is persistent across reboots.

Don’t go to too much trouble with encrypting the password. Anything you can do, a malicious plugin can do. If you provide encode/decode functions in L_PhoneEnc.Lua then a malicious program can just call those. Like all DRM, you aren’t “protecting” anything, just making it more inconvenient to get to.[/quote]

futzle is right to remind us not assume we have “solved security” for this one datum, but I wouldn’t give up on keeping users’ iCloud passwords from sitting around in plain text. That still provides a degree of security in cases where the Vera will just serve out device variables, log files, etc. If the password is stored encrypted, a malicious actor would still need the ability to run code on your Vera (and know which code to run) in order to decrypt it. Not having encrypted it in the first place just makes malicious misuse of the password that much easier.

And for the key, you want to hide a private key in your encrypted module – not some key that others can easily know like the vera_hw_key.