4 ms·
I was playing around with them until I realised they're incapable of being secure. They only have enough ram for one, maybe two TLS sessions at once; to make t
by daurnimator 10y ago
I was playing around with them until I realised they're incapable of being secure.
They only have enough ram for one, maybe two TLS sessions at once; to make things worse, no one has written support for modern (secure) ciphers. The SSL stacks that come with the Espressif SDK are vulnerable to almost every attack you've probably heard of. Slightly better (but not fixed) is https://github.com/superhouse/esp-open-rtos https://github.com/superhouse/esp-open-rtos.
I could no longer rationalise being party to the propagation of the "internet of insecure things". Instead, spend the extra $7 and use something with a bit more power, like a C.H.I.P. http://getchip.com http://getchip.com then you can write normal programs (it's a full linux OS) and not be limited to only insecure protocols.
- goda90 10y agoIs the lack of modern ciphers fixable in software? There are plenty of use cases for one TLS session as are there use cases where security doesn't matter, like sending sensor data.
- callalex 10y agoThere is no such thing as a case where security doesn't matter. Even if a sensor isn't detecting something sensitive, it is probably being fed into a system that does need to be secure and now you have an easy entry point.
- daurnimator 10y ago> Is the lack of modern ciphers fixable in software? There are plenty of use cases for one TLS session as are there use cases where security doesn't matter, like sending sensor data. They don't have enough resources for an 4096 bit RSA negotiation, so they top out at 2048 bit. You may be able to use some of the newer elliptical curve stuff. I was going to try and get nacl/libsodium working on them, but gave up when I realised I can just use a more powerful board instead.