Hacker News Reader

Comment by luma | Hacker News Reader

The author reports two main "security issues":

1) No HTTP basic auth. This isn't a security issue in any way, shape, or form. Author has a personal preference for basic auth but this doesn't mean that changes the security posture.

2) No support for reverse proxy so you can change the root to something non-standard. This is simply security through obscurity and once again has zero bearing on the security posture.

I think the author would do well to understand basic web services security before he starts casting stones here. VPNs work fine if that's what you need, but of course they are too complicated for the author so that solution is dismissed.

View on HN

The author doesn't explain it well, but I use home assistant and I share the same view. Home assistant is not a very secure app. I would be fine putting it behind Nginx with basic auth, because Nginx is quite battle hardened and basic auth is a small attack surface.

I've solved it instead by using Wireguard and keeping home assistant on my private network. No idea why the author thinks VPN is not a good solution. It's also helpful for several other apps I don't feel safe exposing to the internet.

Nginx isn't suggested on the remote access manual page for sure https://www.home-assistant.io/docs/configuration/remote/

But there's addons in the package manager:

> Want to protect the website with a username/password? Well, it can do that too!

https://github.com/hassio-addons/addon-nginx-proxy-manager

> Nginx isn't suggested on the remote access manual page for sure

This makes it seem like they advise against it on that page, which is not true. Nor would it make any sense, putting a reverse proxy in front of a web application before exposing it to the open internet is about as typical as things get.

The problem the author describes is that doing this is not compatible with the mobile app. It doesn't support http basic auth and also can't present a client certificate (that's what I used to secure remote access to other browser based apps)

Home Assistant's Android app does work with client certificates.

https://companion.home-assistant.io/docs/getting_started/#tl...

> I've solved it instead by using Wireshark and keeping home assistant on my private network.

What is wireshark for? Or did you mean wireguard and get autocorrected?

Indeed wireguard. Fixed, tnx

You misunderstood, the main issue is that there's some user/pass auth code of unknown quality exposed, instead of basic auth done by some battle tested httpd implementation like apache/nginx. Which in ideal case, is also split from the application and can be independently updated if needed. That certainly does affect security posture.

No, those two points you raise are completely false.

> Author has a personal preference for basic auth

Adding web server basic auth (and thus adding multi layer security) is objectively more secure than only application level security. Of course some other way of adding web server authentication would be equally okay, but the Home Assistant app doesn't have support for it either.

> This is simply security through obscurity

A secret subpath is not security by obscurity at all. The path isn't obscured in any way; it's a secret. It does have the downside that user agents don't treat URLs as secrets (i.e. it's saved as history), but in this case that isn't too much of a concern.

> This is simply security through obscurity and once again has zero bearing on the security posture.

Not to defend the author or the idea, but this is very clearly untrue. Something similar is routinely done to intentionally break hotlinking usually (tokenized URLs and URL signing). It's ages old and does work, as it's no different to cracking a long and difficult password.

Reply on news.ycombinator.com