# Nodered hacked by adding invisible nodes

**URL:** <https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860>\
**Category:** General\
**Tags:** security\
**Created:** [20 December 2023 08:54 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860 "2023-12-20T08:54:44Z")\
**Posts on this page:** 1\
**Showing post:** 122

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [6 January 2024 13:48 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/122 "2024-01-06T13:48:08Z")

</div>

> [@jbudd](#):
>
> Is it possible to move the prompts for this to the start of the install script, alongside "Do you want to install Pi specific nodes"?

Not easily as this is part of the node-red admin init "script" that can only run after install

> [@jbudd](#):
>
> This maybe implies that the bogey spotted Node-red and then set about the password by brute force

Yes - also true of your gmail account, PayPal, X, instagram etc if you don't set a decent password. The init script does check for a minimum length password but yes I will change the PR to make that longer (8 -\> 16)

> [@jbudd](#):
>
> future enhancement will be to count login attempts

things like this - or the suggestion to make each login take at least 2-3 seconds (which then wouldn't need a call to action IMHO) really need to be in the core - as they would be useful for all users.

> [@GogoVega](#):
>
> What about a restriction on the local network (192.168.1.1/24) - the script can get the IP address and ask the user if it is correct?

We also saw this - [How to 'whitelist' IP address's that can access Node RED](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990) - which also looks useful. There were lots of tweaks suggested - is there a consensus on the "best" version ?

---

_[View the full topic](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860)._