Improve security, the ewelink password is visible, not encrypted or scrambled.
See original GitHub issue-
Please explain your feature request in a one or two sentences. The eWelink plugin password is in plain text and visible in the config.json file or directly in the Homebridge configuration editor. Wouldn’t it be better if it was in base64 or some other kind of encryption instead of plain text, even in an encrypted file.
-
Is your feature request related to a problem? Please describe. Security flaw by having the password visible in plain text instead of an encrypted or scrambled format.
-
Any particular eWeLink devices that this relates to? No
-
Anything else? No
-
Info version Node.js: v14.16.0 npm: v6.14.11 Homebridge: v1.3.4 Homebridge UI: homebridge-config-ui-x v4.41.0 Homebridge Ewelink: homebridge-ewelink v5.5.1
-
Example Current
{
"name": "eWeLink",
"username": "yourmail@domain.com",
"password": "HelloWorld1234",
"mode": "auto",
"platform": "eWeLink"
}
With hidden password in base64
{
"name": "eWeLink",
"username": "yourmail@domain.com",
"password": "SGVsbG9Xb3JsZDEyMzQK",
"mode": "auto",
"platform": "eWeLink"
}
Issue Analytics
- State:
- Created 2 years ago
- Comments:19 (9 by maintainers)
Don’t forget you will also need to tick the “Encoded Password” setting so the plugin knows to decode your password (needed so it doesn’t try to decode any user’s password that hasn’t been encoded in the first place)
v5.1.1 was released before and so doesn’t decode the password.
It’s something I have added to the beta version, you can use the “Install Previous Version” feature in homebridge-ui (the spanner icon on the plugins page) and you can select the top entry which should show ‘v5.5.2-2 - beta’ to install