In LoxBerry's Setup Wizard, a SecurePIN is created, that is needed on password change, plugin installation and other critical areas.

The LoxBerry SecurePIN can be between 4 and 10 characters and may consist of letters and numbers. By default, a 4-digit number is generated.

LoxBerry is accessed with an non-encrypted website, therefore on every click, username and password is transferred between LoxBerry and your webbrowser. Additionally, depending on the plugin, also the Miniserver uses LoxBerry's credentials to communicate with LoxBerry. 

This ongoing transfer of username and password creates a higher risk, that an attacker, that entered your network, could easily find out your LoxBerry credentials. If you access your LoxBerry from the internet, the risk is even higher to get your credentials and access your LoxBerry. 

LoxBerry's SecurePIN in only requested on operations at higher risk, e.g. to show and change passwords, for accessing the filesystem via Filemanager, or for installing plugins. Also the SecurePIN is transfered unencypted, but only if it is requested by LoxBerry. The chance to spy your SecurePIN is much lower as it is not transfered all the time. 

The SecurePIN secures:

• Changing the password of your LoxBerry
• Installing a foreign plugin
• Accessing the filesystem via webbrowser (that could be used to find out passwords in configuration files of LoxBerry or plugins)
• Accessing the mailserver credentials (that could be used to hijack your mail account)
• Accessing the Miniserver credentials (to access your Smarthome)

Also plugins may secure credentials with LoxBerry's SecurePIN.

A plugin has full administrative access to your LoxBerry, including all configuration files, users and passwords. Without SecurePIN, an attacker may create and install a malicious plugin to fully take over your LoxBerry with all your configurations and credentials. That's why LoxBerry secures plugin installations with SecurePIN.

If you haven't run the setup wizard, the default SecurePIN is 0000.

You may get this message, if you failed several times entering the correct SecurePIN. The SecurePIN is locked for approximately 5 minutes.

This is only possible with direct access to the filesystem, logging in directly on the console, or via SSH (Putty).

• Change to the directory /opt/loxberry/config/system/ → cd /opt/loxberry/config/system/
• Delete securepin.dat → rm securepin.dat
• Copy the default SecurePIN → cp securepin.dat.default securepin.dat

To run a secure https website, an SSL certificate is required. Technically, creating a so-called "self-signed certificate" is not a challenge. 

Sadly, the webbrowsers (that force to use SSL) do not trust self-signed certificates and encourage the users to leave the website because it is unsecure (although encryption is enabled).

Getting a valid certificate requires to aquire one at an official certification authority. Furthermore, this certificate is only valid if LoxBerry is accessible from the internet, that we see as a bigger security issue than to locally communicate unencrypted.

Finally, also if LoxBerry would support SSL, we still need to keep open the unencrypted website, as Loxone's Miniserver does not support SSL to communicate with LoxBerry. 

Therefore - keep intruders away from your network!