Do not allow access to cleartext credentials from network

[schlamar]

Issue

Modern IT security is all about layered security. Make each boundary of every application / device as robust as possible. One of the important paradigms is always assume there is an attacker in the network.

One worst case scenario in this context is getting access to credentials (Wifi, MQTT, ...) via an unauthorized network communication.

So I'm not talking about preventing credential leak by physical access as discussed in #2886.

It is OK to store them cleartext on the device. But you should never ever make them readable from the web application or from any other network access.

[caco3]

I agree that it is not good practice. How ever @jomjol (the core dev) once decided he does not want to have the responsibility to protect the device (see eg. #2886). There are several reasons for this. One is the extra work for the devs and the skills that are needed to make it really right and save. An other reason is the lack of CPU resource for this. The ESP simply is very limited and we already are on our limits RAM wise.

[schlamar]

I have seen #2886. Please note this is a fundamentally different use case.

The other issue is talking about protecting against physical access. This would require some sort of encryption. Though a sophisticated attacker would still be able to extract encryption key and decrypt the credentials. This would mean a lot of complexity for minimal benefit. I understand that this is out of scope for this project.

The issue I'm talking about is quite the opposite. This would be trivially to solve for a huge benefit regarding IT security.

A solution would be straightforward by making credential config fields and files containing credentials write only. So you can edit them as it used to be but you cannot read them.

This is how any other web application I know of handles this sort of credential configuration.

[schlamar]

Example how this looks in Tasmota.

[caco3]

files containing credentials write only

Yes, I think that is the only feasable way unless we restrict the access to the UI.