Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SECURITY] Cheap password protection against tune modification #4243

Closed
ElDominio opened this issue Jun 6, 2022 · 6 comments
Closed

[SECURITY] Cheap password protection against tune modification #4243

ElDominio opened this issue Jun 6, 2022 · 6 comments
Assignees
Labels

Comments

@ElDominio
Copy link
Collaborator

ElDominio commented Jun 6, 2022

TL,DR: make tune modification a bit harder
not goal: hide tune
not goal: assertion of tune authenticity

I have many requests of tuners to allow the use of password protection. It doesn't matter to me if the maps themselves are encrypted or not (would complicate things much more)

Only be able to disallow reading/writing through serial until the password is entered, preferably in a submenu under controllers, at which point the ECU correctly responds to read/write requests from Tunerstudio.

Once the correct password is entered, the ECU entered an "unlocked mode", where the tune can be read/written until the lock is reapplied. Could be done with a dialog box with a password entry and a checkbox, once the box is unchecked, the ECU throws an error to ask the user to reconnect for map access.

@duhafnusa4
Copy link
Member

duhafnusa4 commented Jun 6, 2022

you're going to find thats not how rusefi people operate.

after speaking with you I understand and agree with your standpoint :)

@rusefillc
Copy link
Contributor

good solution is not needed, we will start with a lame solution:

  1. new flag which would disable write commands
  2. padlock buttons to unlock
  3. TBD mechanism for password entry and persistance

@rusefillc rusefillc self-assigned this Jun 6, 2022
@NMSTEC
Copy link
Contributor

NMSTEC commented Jun 7, 2022

I like this solution.

@rusefillc rusefillc changed the title Cheap password protection [SECURITY] Cheap password protection against tune modification Jun 28, 2022
@ElDominio
Copy link
Collaborator Author

I was asked to ping two weeks after the ticket was opened so here id a ping a month afterwards

@rusefillc
Copy link
Contributor

Sounds like https://rusefi.com/forum/viewtopic.php?p=34942#p34942 is the way to go here :(

I might have a cadidate for paid development assignments but I do not see myself personally coding this feature in the coming months.

@rusefillc
Copy link
Contributor

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants