WiFi Passcode shows in the clear

  • LibreELEC's implementation of Kodi 18.9 has a first boot wizard which nicely guides a new user through configuring the box but the WiFi passcode entry shows the passcode on the screen. Many people have large TVs in a room with public facing windows and this presents a security risk which extends beyond just the Kodi box, allowing someone to gain access to your WiFi network. In some countries (including the UK where I live) there are laws that require everyone to maintain a level of security that will prohibit unauthorised access to networks. A home owner is legally responsible for traffic originating from their network. This makes me feel very uncomfortable entering a passcode in the wizard.

    Could the passcode entry use a password protection field, e.g. show * instead of the character, possibly briefly showing the entered character before changing to *.

  • Many people have large TVs in a room with public facing windows and this presents a security risk

    How often do you have strangers glued to your house windows, staring into your room, while you are entering a Kodi/LibreELEC setup..?

    I think we're okay on this matter.

  • I'll phrase it in different terms: It's a known and deliberate design choice to show the password in clear. Users are working with an on-screen keyboard and IR remote which encourages mistakes. If you want to set the passwork "privately" accept the defaults on-screen then access the device over SSH to set the password (passwd) without being observed. You can also setup key-authentication to avoid passwords completely.

  • Just staying, windows and typical Desktop Linux distributions have also the opportunity to just c/p the WiFi password. If you need secure wifi access then switch to device based authentication. Otherwise its is insecure by design.