{"id":177,"date":"2022-04-10T20:28:18","date_gmt":"2022-04-11T01:28:18","guid":{"rendered":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/?p=177"},"modified":"2022-04-11T20:42:38","modified_gmt":"2022-04-12T01:42:38","slug":"harrys-status-report-for-apr-10","status":"publish","type":"post","link":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/2022\/04\/10\/harrys-status-report-for-apr-10\/","title":{"rendered":"Harry’s Status Report for Apr 10"},"content":{"rendered":"

This week I have been looking into implementing the API endpoint for communicating with the RPi. I also investigated potential security risks and how to mitigate them. I was able to implement the update_inventory views method with precautions against malicious actors. The current communication protocol should be able to handle the following situations:<\/p>\n

    \n
  1. Someone tries to update another person’s inventory if they manage to get their serial number: we are including a client secret in the POST request for server to validate<\/li>\n
  2. In case of a data breach where all of the serial number and secret pairs are leaked: we are storing the SHA256 hashed string of the client secret in the database<\/li>\n
  3. Someone intercepts the POST request and tries to get the client secret: we will use HTTPS to send the requests so that all of the data is encrypted<\/li>\n
  4. Someone intercepts the POST request and sends it repeatedly to the server (replay attack): we will send a timestamp along with the data and record the latest in the database. Since the request cannot be modified by the attacker, only the first request will be accepted<\/li>\n
  5. Someone brute force the serial numbers on the registration page: we are planning to add CAPTCHA to the page<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    This week I have been looking into implementing the API endpoint for communicating with the RPi. I also investigated potential security risks and how to mitigate them. I was able to implement the update_inventory views method with precautions against malicious actors. The current communication protocol should be able to handle the following situations: Someone tries … <\/p>\n

    Continue reading “Harry’s Status Report for Apr 10”<\/span><\/a><\/p>\n","protected":false},"author":590,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[4],"_links":{"self":[{"href":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/wp-json\/wp\/v2\/posts\/177"}],"collection":[{"href":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/wp-json\/wp\/v2\/users\/590"}],"replies":[{"embeddable":true,"href":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/wp-json\/wp\/v2\/comments?post=177"}],"version-history":[{"count":3,"href":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/wp-json\/wp\/v2\/posts\/177\/revisions"}],"predecessor-version":[{"id":180,"href":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/wp-json\/wp\/v2\/posts\/177\/revisions\/180"}],"wp:attachment":[{"href":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/wp-json\/wp\/v2\/media?parent=177"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/wp-json\/wp\/v2\/categories?post=177"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/course.ece.cmu.edu\/~ece500\/projects\/s22-teamb6\/wp-json\/wp\/v2\/tags?post=177"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}