Oh man, if your SMB was exposed, your old school clear text api password already exposed as well
1 Like
Well. if SMB ist exposed, you have other problems too. The attacker could easily delete your whole system…
1 Like
There is a security risk and a separate technical issue for that Trusted Networks auth provider bypass user selection step. We may allow it when we figure out the solution.
A security risk for an HA instance that does not allow access from the internet?
The emphasis I hoped to communicate was, that a legitimate user can get locked out. Of course there are bigger problems when SMB is exposed. And this doesn’t have to be tied to SMB. Lets say people backup and restore their configurations. Depending on if they include the new folder or not, a restored system won’t work as expected. So there is a chance that people lock themselves out when migrating to another system.
I’m not saying this is a bug or anything like that. I’m just thinking about which problems may result from the new auth system. And just to be clear: I welcome the new auth system and think it’s a great improvement. But the first thing I do when stumbeling upon something like this is thinking about the downsides so they can be addressed and improved. And locking yourself out (even though it would be easy to fix) in case of a desaster recovery seems to be a valid concern for me.
And since I haven’t even upgraded yet I don’t know if what I’m saying here is a problem. I just wanted to raise awareness to a possible issue.
2 Likes
I don’t know other developers, for me, I am using my free time to contribute without any compensation. For my own sake, I don’t want to maintenance two login flow. So if I poke a hole for Trusted Networks auth provider, this hole will open for other auth providers as well.
If you do not want to use any authentication system, that is fine. You can either stay at old version, folk your own project, or make a one line patch to turn off the whole auth system in your local installation. It looks like you are a wisdom people, I am sure you can fairly easy to figure out how to do that.
4 Likes
That sounds like an interesting option. Which line is it?
3 Likes
Let me handle security… I don’t need to be babysat. Thanks.
Way to go guys… this was a brilliant decision.
Is there any API to manually trigger notifications to show them in the new notifications drawer?
Great thanks!
Ok, so what am I missing, given I have a refreshtoken I copied out of my browser, the docs you linked to tell me :
Refresh token
Once you have retrieved a refresh token via the grant type authorization_code , you can use it to fetch new access tokens. The request body is:
grant_type=refresh_token&
refresh_token=IJKLMNOPQRST
The return response will be an access token:
{
"access_token": "ABCDEFGH",
"expires_in": 1800,
"token_type": "Bearer"
}
So unless I’m missing something obvious a call to http://testhass:8123/auth/authorize?grant_type=refresh_token&refresh_token=BLABLA should return a new token, not?
18 hours ago you wrote the same comment and my answer is still the same. You’re not using the endpoint that is written in the docs 0.77: Authentication system 👮♂️ + Hangouts bot 🤖
Which bit do you disagree with exactly? You think the Devs purposely went out of their way to make your life difficult, or there wasn’t a genuine security issue?
If all you use Home Assistant for is to turn on your stereo then I’m sure you’ll be fine to remain on v0.76. I also presume that since you compared HA to a microwave, that it must be a smart microwave, open source, free and updates with new features (after consulting with you of course) on a bi-weekly basis? I’ll have to get me one of those!
I am very happy and grateful for the HA dev team’s hard work. Saying “if you don’t like it, lump it” is not constructive. I am pointing out that introducing breaking changes that kill the entire system is not very user friendly. There has been a consistent trend to not test these breaking changes and to fix problems after the fact. I never know just how much work it will be to accept an upgrade. It has gotten to the point where I have to have have a second system to prototype upgrades because I don’t want to be dead in the water for an unknown period of time. I’m also not the only person using this set-up. My wife is not happy if nothing works. Of course the application is 0.x, not 1.x so stability is not entirely expected. BUT in the 0.5x timeframe it was defintely “Production Stable” for my home automation. Recently it has been super flaky and the devs are clearly focused on new features than stability. Community feedback to focus on stability is not being ungrateful.
2 Likes
Any love for us Hass.io peeps? Only update I’ve waited for this long, patiently awaiting some of these new updates.
1 Like
Focusing on security should be applauded, its a pity other software developers don’t do it. For those that don’t like the new “feature” stay on 76 and you’ll be fine, For the rest of us who do expose our system to the outside and security is a concern, we’ll keep moving on.
2 Likes
I really don’t get the hangouts message sending
- alias: hangout_checker
trigger:
- platform: state
entity_id: input_boolean.send_message
to: 'on'
action:
- service: hangouts.send_message
target:
- id: !secret hangout_id
message:
- text: "automated message"
this returns an configuration error. I also can’t work out how to format the call service from appdaemon, if you could explain that as well.
I just upgraded from 76.2 to 77.1 and created the new user… all well except I had to take out static assignements for my wemo gear to be recognized on startup.