neighborhood-watch-alarm / nwa

Neighborhood Watch Alarm
https://nwa-site.herokuapp.com/
MIT License
3 stars 0 forks source link

Hashing of passwords in database #8

Open mikkelgthang opened 4 years ago

mikkelgthang commented 4 years ago

The passwords belonging to people's houses are being hashed before travelling through TTN, and then unhashed by the server. This is all fine. The passwords are however not hashed before being saved to the database files. These files are only ment to be stored locally and aren't human readable, but in case someone has acces to the server program and the corresponding database files for a neighborhood, it would be possible to retrieve the information fairly easy.

Therefore, the passwords should be hashed before being saved to the database, and the retrievel of logindata over TTN should account for this.