Authentication and Permissions #8

New issue

Open

opened 2019-02-22 14:57:48 +01:00 by bmartin5692 · 1 comment

bmartin5692 commented

2019-02-22 14:57:48 +01:00

(Migrated from github.com)

Related to #7

The EcoVacs app encrypts the username/password with the public key of EcoVacs when authenticating. Since we don't have the private key to decrypt, there is no way to provide true security and authentication within bumper. Bumper is not able to get the submitted username/e-mail/password of the user connecting.

What can be done:

Simple auth via the web server
- This would break the apps and require custom sucks clients
Use a simple but insecure authentication mechanism based on what clients send, then track those with permissions a user can configure.

Going with the idea of option 2:
Each client app (iPhone, Android, Sucks) has a deviceid that is submitted when logging in.

With this new mechanism users will be able to:

Configure user accounts in bumper.
- Each user account can have one or more client deviceids attached to it.
- Each user account can have one or more bots attached to it.

When a user connects with a client, bumper will correlate the deviceid to the user account. Then a unique token will be generated similar to how EcoVacs tracks them and that token will be tracked as part of the session. Tokens will be destroyed at logout or after X amount of time.

Bumper will only provide a list of bots that the user has attached to their account.

With this in place, additional layers can be added on top such as IP filtering.

Related to #7 The EcoVacs app encrypts the username/password with the public key of EcoVacs when authenticating. Since we don't have the private key to decrypt, there is no way to provide true security and authentication within bumper. Bumper is not able to get the submitted username/e-mail/password of the user connecting. What can be done: 1. Simple auth via the web server - This would break the apps and require custom sucks clients 2. Use a simple but _**insecure**_ authentication mechanism based on what clients send, then track those with permissions a user can configure. **Going with the idea of option 2:** Each client app (iPhone, Android, Sucks) has a deviceid that is submitted when logging in. With this new mechanism users will be able to: * Configure user accounts in bumper. * Each user account can have one or more client deviceids attached to it. * Each user account can have one or more bots attached to it. When a user connects with a client, bumper will correlate the deviceid to the user account. Then a unique token will be generated similar to how EcoVacs tracks them and that token will be tracked as part of the session. Tokens will be destroyed at logout or after X amount of time. Bumper will only provide a list of bots that the user has attached to their account. With this in place, additional layers can be added on top such as IP filtering.

bmartin5692 commented

2019-05-02 14:29:17 +02:00

(Migrated from github.com)

I'm not going to work on this, but will leave this in case it comes up in the future. For now, bumper has use_auth = False in __init__.py:
a0721d7f79/bumper/init.py#L26

The basics for this are in the code, but after using bumper for some time I just don't need this. If I'm outside my home I can VPN back and the app works fine. My insider threat concerns are low, but perhaps this could be useful for some sort of API layer. I'm not going to work on this, but will leave this in case it comes up in the future. For now, bumper has `use_auth = False` in `__init__.py`: https://github.com/bmartin5692/bumper/blob/a0721d7f7911879617b2a60d84d7dabf00a5f1f7/bumper/__init__.py#L26