homeassistant

20955 readers

25 users here now

Home Assistant is open source home automation that puts local control and privacy first.
Powered by a worldwide community of tinkerers and DIY enthusiasts.

Home Assistant can be self-installed on ProxMox, Raspberry Pi, or even purchased pre-installed: Home Assistant: Installation

Discussion of Home-Assistant adjacent topics is absolutely fine, within reason.
If you're not sure, DM @GreatAlbatross@feddit.uk

founded 3 years ago

MODERATORS

GreatAlbatross@feddit.uk

greatalbatross@lemmy.world

"Insecure secrets detected in app configuration" (lemmy.world)

submitted 2 days ago by limelight79@lemmy.world to c/homeassistant@lemmy.world

9 comments fedilink hide all child comments

PSA - if you're seeing this message, along with:

"App Advanced SSH & Web Terminal uses secrets/passwords in its configuration which are detected as not secure. See pwned passwords and secrets for more information on this issue."

The translation is that your password (in this example, for the Advanced SSH & Web Terminal app) was found in the Have I Been Pwned database. The link given in the message is to their page on HIBP, so you might infer it, but it's not obvious that's what they are saying by the wording of the message.

It does not necessarily mean your HA system has been compromised, just that the (likely) same password appears there. So, if you use "hunter2" as a password, and someone else used it for a site that was then compromised, you'd get this message for your "hunter2" password.

Obviously, using an easily guessable password, or the same password for multiple services (hey, we've all done it), isn't good security practice; best to change your password. You can ignore this warning if you like, but from a security point of view, it's not a great idea.

I found the message very confusing - I thought it was telling me that I was storing passwords in plaintext somewhere. Well, clearly I am (since HA was able to check it against the HIBP database), but that's not what the message means. The concern is the password was FOUND there.

I'm not sure why they didn't just say something like, "Your password is in the HIBP database, here's a link for more info. You should change it." That's much clearer than "detected as not secure".

I like the idea of this check, though I know not all will agree (given it's sending info out), but I wish the message was clearer.

(Note, they don't actually send the password to HIBP - it is hashed and compared that way, something like that. I don't know the technical details.)

top 9 comments

sorted by: hot top controversial new old

[–] CompactFlax@discuss.tchncs.de 9 points 2 days ago (1 children)

The message to me initially indicated that the storage of the secret was insecure. Now I understand it’s the actual secret which has been found in a breach.

[–] limelight79@lemmy.world 2 points 2 days ago

Yeah, exactly how I read it, too.

[–] Brewchin@lemmy.world 4 points 2 days ago (1 children)

Thanks for the heads up.

Also have an upvote for the bash.org reference with hunter2 😄

[–] pmtriste@lemmy.world 7 points 2 days ago (1 children)

Reference to what? All I see is *******

[–] Brewchin@lemmy.world 3 points 1 day ago

Wow, that's amazing. I'm typing hunter2 and you can't see it?

That website was amazing. 😄

[–] KairuByte@lemmy.dbzer0.com 4 points 2 days ago

The comparison is done by hashing your password, sending some of the first few characters of the hash to HIBP, receiving hashes that match that pattern, then locally comparing the full hashes.

So there’s no concern that credentials are being leaked (despite the other post earlier this month insisting HA was leaking all your secrets) as you can’t really leak a password with a partial hash (you can narrow an attack surface very slightly, I admit), and all actual true comparisons are done locally.

[–] samwwwblack@feddit.uk 3 points 2 days ago (2 children)

There is an option to disable it through the ha CLI if wanted; https://github.com/home-assistant/home-assistant.io/issues/49314#issuecomment-6224767556

As an aside, that issue doesn't really reflect well on HA or frenck.

[–] KairuByte@lemmy.dbzer0.com 2 points 2 days ago

The way Frenck handled the tone initially was mostly okay, though he really should have properly addressed the concern with details as he did in his final comment. The comments in between are pretty dismissive, I agree.

That said, there’s no real issue of information being leaked. The first 5 characters of a hash are all but useless to an attacker. Admittedly, it does raise the attack surface very slightly, and should be opt in instead of opt out. Or at the very least be enabled by default and presented during onboarding.

That said, there’s way this works doesn’t ring any alarm bells to me.

[–] limelight79@lemmy.world 1 points 1 day ago

Of course, it already happened, unless you literally just installed. If you read the last comment closely, the feature to check HIBP has been there for a while, but the message about it was blocked until recently. So if you really didn't want to do this check.... Well, too bad, it's done.

I love HA, but the messaging is not always great. There was a new feature a while back that had a lot of people upset (I'm pretty sure it was automatically encrypting all backups), and the developers just kept saying, "It was in the release notes." I always review the release notes before installing, and I definitely missed that, so I went back to read them with that in mind, and I still couldn't find it. After a few minutes, I realized it was in there, sort of - it was just implied, not explicitly stated. Why not just say, "HA will now encrypt backups by default"?

I've actually had training in using plain language in business writing, so maybe it's just more obvious to me. Unfortunately, I do not have the time to help that much, and we'd have to convince them there is an issue there, first.