-1

I am following wonderful tutorials on how to connect a RPi Pico W to my home AP. Everything works flawlessly. However, I had a question on how the wifi SSID and password are stored(securely?) on the Pico W device.

Adafruit's documentation (circuit python): https://cdn-learn.adafruit.com/downloads/pdf/pico-w-wifi-with-circuitpython.pdf RPis documentation (micro python): https://projects.raspberrypi.org/en/projects/get-started-pico-w/2

My question is can I (or a bad actor) view the plain text settings.toml file containing sensitive information if the Pico W is connected to a computer via microusb? If so, is there any way to secure/encrypt that information?

I plan on putting the Pico W outside the house (but within Wi-Fi range) for reporting soil moisture readings using one way MQTT communication to my home assistant. I will create a separate VLAN on my access point that never connects to the internet nor will it have access to any other device (except MQTT broker) in the house, but still I don't have a proper answer to the above.

For the more powerful RPi W,2,3,4,5 etc. the username and password are stored behind sudo access (wpa_supplicant.conf), so as long as bad actor doesn't have sudo access, it will be tougher (not impossible) to access the same details.

Happy to hear any recommendations/suggestions to follow good practices. Thank you!

3
  • If someone has physical access to a device (be it a Pico or any other) they can access the data it contains.
    – Milliways
    Commented Oct 8, 2023 at 21:35
  • @Milliways - Thank you for the reply. That is very true. I will look into alternative ways. I found an interesting raspberry pi article on using BLE on the Pico W to transmit (and receive) data to another Pi (within range) without having to potentially expose WiFi details. Its mentioned here: raspberrypi.com/news/getting-to-grips-with-bluetooth-on-pico-w Commented Oct 8, 2023 at 23:04
  • Abandoned post by Unregistered user.
    – Milliways
    Commented May 4 at 1:19

2 Answers 2

0

As @Milliways comment physical access to a device = They can access the data in it.

But your question was through the USB port and to that its a maybe.

As for storing passwords. Passwords should never be stored in clear text and there is techniques where you hash the password and then store the hash. A short explanation of hash, is is a one way function where you create a fingerprint, but you can not create the password from the fingerprint, a one way function.

Ref.: Password Storage Tier List: encryption, hashing, salting, bcrypt, and beyond

1
  • The RP2040 sends the password to the CYW43439 WiFi chip as a simple text string; a password hash can't be used.
    – jayben
    Commented Nov 9, 2023 at 19:18
0

You could use simpler Pico (model H) or Pimoroni Tiny 2040 for outside sensors and use small LoRa modules like the RFM95 to send sensor data. As a bonus, the distance covered by LoRa is much longer than with Wi-Fi. This way there would be no need to save any Wi-Fi information there in the sensor microcontroller's firmware.

Then you could have another RFM95 connected to an ESP32 microcontroller that would act as the base station receiving the data from sensor(s). The ESP32 can be properly secured with secure boot and partition. The ESP32 can also run MQTT commands (for example via marvinroger/AsyncMqttClient) to pass the data on to HomeAssistant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.