Meta: Security and Privacy

[mitra42]

Meta task for security and privacy issues

• MQTT client in browser should operate over SSL
• MQTT client in browser should be constrained on what it can receive based on permissions
• MQTT client in browser should login based on organization configuration instead of public/public
• MQTT client in Logger should login to each organization with a separate password - holding multiple connections as reqd
• MQTT client in Node should be constrained based on permissions.
• Server - userid an password should be in config.d files and not in GIT #90
• WiFi configuration: pick up GPS #44 - should only be able to set location based on some kind of access control
• HTML Server should be https not http See HTML server #41
• HTML Server should control access to data and config based on a login (user not organization) See HTML server #41
• MQTT Client should have a user password, not an organizational one See HTML server #41
• OTA security needs thinking thru See Setup OTA option #37

Reference

• Node Red is also in JS and has notes on securing it here that might be useful - especially using "Passport" as a framework with multiple authentication options
• Passport may be the solution - drop inable on express