Let's say I change the password for the root & pi user to something impossible to brute force, say 20 characters.
Then in one of my files on my raspberry pi, I hardcode a password.
Is this password secure? The user has unlimited physical access to the raspberry pi. (I am selling a device with a pi connected to it).
What if I use full disk encryption?
In case anyone is asking why I am doing this, I have a server endpoint that registers serial numbers of pi's I sell. Only registered serial numbers can access my server's platform. I don't want to have to plug in every raspberry pi I sell into a computer and copy the serial number into the database on my server. Instead, the sd card for the raspberry pi includes a script that encrypts the serial number and sends it to my server.
On my server, if decryption is successful, then it implies the serial number is valid and came from a raspberry pi. (Note I use aes-256-gcm
).
In this way, I am hoping that all I have to do is flash a new sd card in order to sell my device. (As opposed to flash sd card + insert to raspberry pi + cat /proc/cpuinfo to get the serial number + POST that to my server).
If the file with a password is not secure, what can I do to secure it?