No security protection - Githubissues

Friedjof / ESP32-433API

This is a 433MHz web-API for the esp32 microcontroller

1 stars 0 forks source link

No security protection #5

Open bschlagheck opened 2 years ago

bschlagheck commented 2 years ago

The service has no security protection so far. Anyone in the corresponding network of the service can access and send data. There are several protection mechanisms:

Using HTTPS as transport security and protection against data retrieval.
Use of one-time passwords to ensure authorized use of the service.

Friedjof commented 1 year ago

SSL

Unfortunately SSL is not supported for the ESP32 as far as I could research it.

Sources

https://gitlab.users.ch.eu.org/smarthome/eaws-ssl-updater
https://github.com/me-no-dev/ESPAsyncWebServer/issues/899#issuecomment-748380346
TOTP

TOTP still causes me some problems, because I can't find a suitable lib for it. There are some, but I don't get the same result with correct time as on other TOTP clients. Therefore I can't implement it yet.

Source
https://github.com/lucadentella/TOTP-Arduino/issues/16