# Nodered hacked by adding invisible nodes

**URL:** <https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860>\
**Category:** General\
**Tags:** security\
**Created:** [20 December 2023 08:54 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860 "2023-12-20T08:54:44Z")\
**Posts on this page:** 4\
**Page:** 8

<div class="post-metadata">

**Author:** ![meeki007](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/meeki007/32/12499_2.png) [@meeki007](https://discourse.nodered.org/u/meeki007)\
**Post date:** [6 January 2024 19:55 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/142 "2024-01-06T19:55:11Z")

</div>

> [@jbudd](#):
>
> Four letter passwords are \*\*\*\*!

???  
good, wise, gold, pure ..... !

---

<div class="post-metadata">

**Author:** ![Becker](https://avatars.discourse-cdn.com/v4/letter/b/c77e96/32.png) [@Becker](https://discourse.nodered.org/u/Becker)\
**Post date:** [6 January 2024 21:10 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/143 "2024-01-06T21:10:05Z")

</div>

> [@TotallyInformation](#):
>
> There are online tools that you can use to test your password. Basic auth is really very simple to crack I believe. And of course, we are assuming that you are using TLS with recommended modern settings? A password with no TLS is worse than useless of course.

I use Nginx Proxy Manager (Docker) with Let's Encrypt SSL - it´s only one mouse click - I don´t know much about it. It's a shame that fail2ban isn't integrated into the nginx docker.

I tried [https://checkdeinpasswort.de/](https://checkdeinpasswort.de/) and I will extend it to \> 15 years been cracked 😉

> [@TotallyInformation](#):
>
> PS: The bigger issue you have with an in-car system is that the most likely security issue is going to be actual theft - either of the whole car or the device. Either way, someone now has the full device and all data. Most likely they will simply pawn the device but you will never be able to trust any password set on that device again.

the browser forgets the password after a few hours. I think Elon won't allow it 🤣

---

<div class="post-metadata">

**Author:** ![gregorius](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gregorius/32/73816_2.png) [@gregorius](https://discourse.nodered.org/u/gregorius)\
**Post date:** [6 January 2024 21:12 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/144 "2024-01-06T21:12:50Z")

</div>

You see, your password was blanked out.

😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [6 March 2024 21:12 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/145 "2024-03-06T21:12:54Z")

</div>

Closed on 6 March 2024 21:12 UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

[Previous page](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860.md?page=7)