How to "lock" mpremote access to ESP32 board

[MatejKovacic]

I have a small ESP32 board running an app that is writing some text on built-in OLED screen and to a serial console.

Now, the problem is, that anyone can copy my main.py file from the device with mpremote and change it. It it possible to somehow "lock" the device that it would not be possible to see .py (or other) files on it? If I use machine.UART(0).deinit(), app is not running (i. e. I can not see the data on the serial console). What are other options?

(Warning: total newbie here)

[yfyungit]

https://github.com/micropython/micropython/wiki/Securing-a-MicroPython-system

[Josverl]

Thanks for linking there ,
I just updated that wiki page with some solutions from other threads.

[shariltumin]

If anyone is interested in this topic, please take a look at
https://github.com/shariltumin/password-protected-REPL-micropython

[Josverl]

Very nice addition 👌 !
Do I understand correctly that I would need to toggle Pin(23) before I can get access , or is that the Physical-Access override ?
Two suggestions :

• Add Salt to the cryptographic functions:
  There is no use of a salt when hashing or encrypting the UID and password. This makes it vulnerable to rainbow table attacks.

• Add delays to avoid Brute Force Protection:
  The implementation allows three attempts for authentication but does not implement any delay or blocking mechanisms after failed attempts, making it susceptible to brute force attacks. Even though the device reset and network reconnect will add some delay, it is common practice to have a increasing delay after failure.