Shelly-homekit: Shelly Access Security

[marmitol]

Hello.
It's not an Issues, it's a security request for future versions. It would be nice if the management could be accessed via https, username and password.

It's a suggestion.

Thank you very much,

[Whiterabbit64]

Hello.
It's not an Issues, it's a security request for future versions. It would be nice if the management could be accessed via https, username and password.

It's a suggestion.

Thank you very much,

I confirm, it’s a must have feature.

[andyblac]

can i ask why ?, do you guy's expose port 80 on your IoT VLAN to the web ?, if so you would also require a security certificate ?

[Whiterabbit64]

can i ask why ?, do you guy's exposed port 80 on your IoT VLAN to the web ?

Because a WiFi network can’t be secured at 100%. So if an attacker goes through, then it’s better to have a second security. So securing Shelly Homekit with https and user/pass would be great.
If not, once the Wifi is hacked, then opening the garage doors is not an issue 😁

[andyblac]

ok, noted.

[andyblac]

then also, maybe an option to allow the user to chose the port that webpage is hosted would also help ?, port 80 is very common....

[rojer]

HTTPS with a proper certificate is impossible. self-signed is theoretically possible but wouldn't make much sense. authentication - agree, we should have it.

[Jaguaza]

I think with a username - password and serious port choice the most recommended. yes.

[andyblac]

that what i was thinking HTTPS there would not be enough space on device, but HTTP with login should be enough.

[Jaguaza]

que lo que estaba pensando HTTPS no habría suficiente espacio en el dispositivo, pero HTTP con inicio de sesión debería ser suficiente.

Othe firmware type, tasmota, espurna use http. I don't think it's a big problem. Even the user is default which is one less security option.

[epiphany11]

HTTP Access would be fine (username + password) like shelly original firmware.

[sebastianheise]

Only somewhat related to this ticket, but:
Currently WPA2 encryption for Wifi is supported.
Is it possible/useful to also support WPA3 as well?

[nachumk]

+1
This is pretty important for me as well - access to one's WiFi would enable someone to control secure devices that are implemented with Shelly1. Whereas other HomeKit devices can't be controlled via WiFi alone. Locking down access to these devices with a secure HTTPS login would be of great use.

[andyblac]

we would need an API token aswell if this is done.

[timoschilling]

If we use HTTP Basic Auth for the UI we can use it for the API as well, http://<user>:<password>@<host>/rpc/... should work.

[andyblac]

If we use HTTP Basic Auth for the UI we can use it for the API as well, http://<user>:<password>@<host>/rpc/... should work.

no way!!!, i will use clear text password in an API request. your asking for trouble and be hacked.

[timoschilling]

What's the difference between an clean text password and an api key? Both is readable if we don't have https and the user:password will be encoded as an token and send via header.

[andyblac]

What's the difference between an clean text password and an api key? Both is readable if we don't have https and the user:password will be encoded as an token and send via header.

i do not trust giving the clear text password to another manufacure device (ie stock shelly fw aka Button1 to control a homekit shelly). that device "could" have access to other cloud servcies and other remote services.

with an API Token it can not get acces to the webUI of the shelly homekit device,

[andyblac]

the API token can be any random key, that can be changed at any time by the user, you could even go like apples app password feature, and allow multple tockens per device, could have one for each device that requires tocken access.

but one should be sufficient.

[andyblac]

i'll leave this open as it is a good request.