Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security issue, default key #80

Open
jmgurney opened this issue May 5, 2022 · 0 comments
Open

Security issue, default key #80

jmgurney opened this issue May 5, 2022 · 0 comments

Comments

@jmgurney
Copy link

jmgurney commented May 5, 2022

Per the code at:

zigpy.config.cv_key([1, 3, 5, 7, 9, 11, 13, 15, 0, 2, 4, 6, 8, 10, 12, 13])

If a key is not provided, an insecure key is used. Many applications do not provide a key, such as home assistant (at least at one point it did, they may have fixed it), which means that networks deployed w/ this default key are easy to hijack and control.

Please make it an error to not provide a secure key, or generate a secure key by default. A warning in the later case is likely useful as a restart will cause problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant