Arduino Stack Exchange is a question and answer site for developers of open-source hardware and software that is compatible with Arduino. It only takes a minute to sign up.
Sign up to join this community
I'm playing with Over The Air (OTA) updates in my LoLin. I can make connections to my router and OTA updates seem to work well.
I'm uncomfortable storing my WiFi router SSID and password unencrypted in every sketch. Can I store an encrypted password instead for use in WiFi.begin()?
For example, Linux has wpa_pasphrase, which generates a 32-byte number which is an encrypted version of the password which can safely be stored in plaintext configuration files.
Can I store an MD5 password hash instead
No. MD5 is a "trapdoor" algorithm. It's one-way. You can make a hash from a password but you cannot make a password from a hash.
You could AES encrypt it, but you would need to have the AES key in your sketch to decrypt the password, which just moves the problem elsewhere.
Typically in a real-world situation you wouldn't have either the SSID or the password in the sketch. Instead you'd create a configuration system which would allow you to set (and of course change) both the SSID and password at runtime, and have the data stored somewhere (either EEPROM or in a file in SPIFFS, for example).
You might want to take a look at WiFiManager which automates that process for you.
I use Tzapu's WiFiManager https://github.com/tzapu/WiFiManager.
That starts your ESP as a WiFi access point (AP mode) which presents a web page at http://192.168.4.1 where you enter your WiFi SSID and password. It then stores the password and restarts WiFi as a station (STA mode).
On restart if the password is already stored then it just connects as a station.
If the SSID can't be found it runs the access point again.
I laud your intention and wish there were a good solution on the ESP8266 for what you're trying to do.
MD5 is a one-way hash function, so you won't be able to simply recover the original string to use in WiFi.begin().
MD5 is also considered to be "cryptographically broken and unsuitable for further use" as of 2008. So if you're concerned about more than just a casual eavesdropping attack sniffing out your password, MD5 isn't considered good for any kind of security application these days.
You'd need to use some form of reversible encryption, but you'd still need to store the key somewhere. If you were using an ESP32, it has the capability of encrypting its flash storage, but the ESP8266 can't do that, so you'll always be vulnerable to someone recovering keys or passwords if they get sufficient access to the CPU.
While it IS possible to reverse a password hash, especially MD5 (https://md5decrypt.net/en/), it doesn't buy you anything in the way of security since everyone else can also reverse them.
If you happen to have a second LoLin, you could set it up as an Access Point and have the first device connect to it instead of having it connect to your router. Then you could relay the communication to a PC over USB.
Sure, it's a bit of a pain, but it at least means that you don't have to expose your router's password on a device that someone can pick up and walk off with.
