Insecure authentication in HC2

[ComputerScience 0]

Hi,

So I noticed that the Home Center 2 UI uses the HTTP method POST to transfer the username/password when a user is trying to authenticate (log in). This basically means that the username and passwords are sent in clear text. Free to be seen by anyone attached to the same network using a packet sniffer. I actually confirmed this statement using wireshark.

One could argue that if a user has access to the local network, he should also be able to access the home center. But this is not always the case. And this issue becomes more critical if the Home Center will be managing security tasks.

What's your opinion on this issue?

How to be solved?

I think adding HTTPS protocol as an option would solve this security issue.

And there is nothing to lose switching to https, especially not adding it as an alternative to HTTP.

[Guest ericf]

HTTPS will use a little more resource ...

No not complicate to implement HTTPS on Apache ...

[ComputerScience 0]

Well the resource difference is negligible in this case, especially as it goes over the local network.

Nevertheless I found out that they already use HTTPS when accessing the HC from home.fibaro.com (over the internet) , so the implementation is already there.

I suggest that they add HTTPS as an alternative, not as an replacement, to HTTP.

[Guest Fidziu]

ComputerScience,

Its not a problem we can put it in our time line, but we didnt focus on that becouse of local network.

remote acces is encrypted.

[Pascal 0]

ComputerScience,

Its not a problem we can put it in our time line, but we didnt focus on that becouse of local network.

remote acces is encrypted.

Hello Fidziu,

My HC2 is shared on the internet so on my office i can connect on my HC2.

I connect me to my HC2 with my domain name hc2.mydomain.com and this URL is forwarded to my external IP .

The connexion to my HC2 is HTTP and not HTTPS and not secure .

I think that with a update you can autorize the user to add his certificat to active the HTTPS to have a secure connexion .

I not use the home.fibaro.com i use my domain name to my external IP .

Kind regards

Pascal

[pooh 2]

yeah, it would be great if this feature can be prioritized.