4 ms·

The author reports two main "security issues": 1) No HTTP basic auth. This isn't a security issue in any way, shape, or form. Author has a personal preferenc

by luma 2y ago

The author reports two main "security issues": 1) No HTTP basic auth. This isn't a security issue in any way, shape, or form. Author has a personal preference for basic auth but this doesn't mean that changes the security posture. 2) No support for reverse proxy so you can change the root to something non-standard. This is simply security through obscurity and once again has zero bearing on the security posture. I think the author would do well to understand basic web services security before he starts casting stones here. VPNs work fine if that's what you need, but of course they are too complicated for the author so that solution is dismissed.

t0mas88 2y ago
The author doesn't explain it well, but I use home assistant and I share the same view. Home assistant is not a very secure app. I would be fine putting it behind Nginx with basic auth, because Nginx is quite battle hardened and basic auth is a small attack surface. I've solved it instead by using Wireguard and keeping home assistant on my private network. No idea why the author thinks VPN is not a good solution. It's also helpful for several other apps I don't feel safe exposing to the internet.
- yjftsjthsd-h 2y ago
  > I've solved it instead by using Wireshark and keeping home assistant on my private network. What is wireshark for? Or did you mean wireguard and get autocorrected?
  - t0mas88 2y ago
    Indeed wireguard. Fixed, tnx
- Maxious 2y ago
  Nginx isn't suggested on the remote access manual page for sure https://www.home-assistant.io/docs/configuration/remote/ https://www.home-assistant.io/docs/configuration/remote/ But there's addons in the package manager: > Want to protect the website with a username/password? Well, it can do that too! https://github.com/hassio-addons/addon-nginx-proxy-manager https://github.com/hassio-addons/addon-nginx-proxy-manager
  - perching_aix 2y ago
    > Nginx isn't suggested on the remote access manual page for sure This makes it seem like they advise against it on that page, which is not true. Nor would it make any sense, putting a reverse proxy in front of a web application before exposing it to the open internet is about as typical as things get.
  - t0mas88 2y ago
    The problem the author describes is that doing this is not compatible with the mobile app. It doesn't support http basic auth and also can't present a client certificate (that's what I used to secure remote access to other browser based apps)
    - charleslmunger 2y ago
      Home Assistant's Android app does work with client certificates. https://companion.home-assistant.io/docs/getting_started/#tls-client-authentication https://companion.home-assistant.io/docs/getting_started/#tl...
rini17 2y ago
You misunderstood, the main issue is that there's some user/pass auth code of unknown quality exposed, instead of basic auth done by some battle tested httpd implementation like apache/nginx. Which in ideal case, is also split from the application and can be independently updated if needed. That certainly does affect security posture.
perching_aix 2y ago
> This is simply security through obscurity and once again has zero bearing on the security posture. Not to defend the author or the idea, but this is very clearly untrue. Something similar is routinely done to intentionally break hotlinking usually (tokenized URLs and URL signing). It's ages old and does work, as it's no different to cracking a long and difficult password.
throwaway89201 2y ago
No, those two points you raise are completely false. > Author has a personal preference for basic auth Adding web server basic auth (and thus adding multi layer security) is objectively more secure than only application level security. Of course some other way of adding web server authentication would be equally okay, but the Home Assistant app doesn't have support for it either. > This is simply security through obscurity A secret subpath is not security by obscurity at all. The path isn't obscured in any way; it's a secret. It does have the downside that user agents don't treat URLs as secrets (i.e. it's saved as history), but in this case that isn't too much of a concern.

by luma 2y ago

t0mas88 2y ago

The author doesn't explain it well, but I use home assistant and I share the same view. Home assistant is not a very secure app. I would be fine putting it behind Nginx with basic auth, because Nginx is quite battle hardened and basic auth is a small attack surface. I've solved it instead by using Wireguard and keeping home assistant on my private network. No idea why the author thinks VPN is not a good solution. It's also helpful for several other apps I don't feel safe exposing to the internet.

yjftsjthsd-h 2y ago
> I've solved it instead by using Wireshark and keeping home assistant on my private network. What is wireshark for? Or did you mean wireguard and get autocorrected?
- t0mas88 2y ago
  Indeed wireguard. Fixed, tnx
Maxious 2y ago
Nginx isn't suggested on the remote access manual page for sure https://www.home-assistant.io/docs/configuration/remote/ https://www.home-assistant.io/docs/configuration/remote/ But there's addons in the package manager: > Want to protect the website with a username/password? Well, it can do that too! https://github.com/hassio-addons/addon-nginx-proxy-manager https://github.com/hassio-addons/addon-nginx-proxy-manager
- perching_aix 2y ago
  > Nginx isn't suggested on the remote access manual page for sure This makes it seem like they advise against it on that page, which is not true. Nor would it make any sense, putting a reverse proxy in front of a web application before exposing it to the open internet is about as typical as things get.
- t0mas88 2y ago
  The problem the author describes is that doing this is not compatible with the mobile app. It doesn't support http basic auth and also can't present a client certificate (that's what I used to secure remote access to other browser based apps)
  - charleslmunger 2y ago
    Home Assistant's Android app does work with client certificates. https://companion.home-assistant.io/docs/getting_started/#tls-client-authentication https://companion.home-assistant.io/docs/getting_started/#tl...

rini17 2y ago

You misunderstood, the main issue is that there's some user/pass auth code of unknown quality exposed, instead of basic auth done by some battle tested httpd implementation like apache/nginx. Which in ideal case, is also split from the application and can be independently updated if needed. That certainly does affect security posture.

perching_aix 2y ago

> This is simply security through obscurity and once again has zero bearing on the security posture. Not to defend the author or the idea, but this is very clearly untrue. Something similar is routinely done to intentionally break hotlinking usually (tokenized URLs and URL signing). It's ages old and does work, as it's no different to cracking a long and difficult password.

throwaway89201 2y ago

No, those two points you raise are completely false. > Author has a personal preference for basic auth Adding web server basic auth (and thus adding multi layer security) is objectively more secure than only application level security. Of course some other way of adding web server authentication would be equally okay, but the Home Assistant app doesn't have support for it either. > This is simply security through obscurity A secret subpath is not security by obscurity at all. The path isn't obscured in any way; it's a secret. It does have the downside that user agents don't treat URLs as secrets (i.e. it's saved as history), but in this case that isn't too much of a concern.