Integrated full disk encryption

Feature Requests
1

o/ Greetings!

Home Assistant OS currently lacks integrated full disk encryption, leaving sensitive data (e.g., credentials, secrets, security cameras footage and logs) exposed if the storage is stolen.

Implementation of that kind would align HAOS with best security practices and provide users with an additional layer of protection.

This is probably a long shot, but it is my personal opinion that a software of the high rank like HA should have that.

Thanks!

2

You can (should?) vote for your own feature request! :wink:

Did you gave a thought how to unlock a (headless) HaOS upon boot? :thinking:

1 Like
3

Hey! Not sure, what you mean - perhaps that there are other roadblocks rather than FDE to get that sweet sweet data? Absolutely, but if someone is really interested in someone’s secrets (and they face challenges with unlocking HAOS) honestly, just exfiltrating the content would get the job done.

4

I just read again your comment again from that other post: Any way to encrypt HA?

At this point I am really trying to squeeze my resources as much as possible, and getting another VM (debian or anything) to host another application is something that I want to avoid.

5

A full disk encrypted system needs the secret/passphrase before it can (fully) boot. For a client that is usually quite easy (password prompt) but for (headless) servers that might be more challenging. :see_no_evil:

What could be used for example is a USB stick/drive which contains the secret - but humans are humans and if the drive will just be always in the server for “reliability” (e.g. restarts for update) it is just as useful as lock :lock: with the key :key: inside :person_shrugging:

6

You’re right. Another approach could be to leave FDE behind and encrypt only a dataset that needs to be unlocked via http login form, and after that the rest of the workers start and are able to write data to it. That would probably require to redisign HA from the ground up, so it really isn’t realistic approach.

Then again, I’m no dev so my guess is as better as the next guy’s.

7

My 5 cents: access to HA is already password protected, so encrypting only sensitive files inside HA would probably be enough. That way looking from outside (that’s ssh etc…) these files would be encrypted, but when login into HA looking them would be possible.

Encrypting whole system just slows down whole thing…

8

so encrypting only sensitive files inside HA would probably be enough

How is HA implementing encryption on sensitive files?

That way looking from outside (that’s ssh etc…) these files would be encrypted

This is honestly a bad argument. Data is either encrypted or not. SSH authorization does not mean encrypted data. It means SSH authorization to the system that holds data in plaintext. Again, getting your hands on the storage will render any SSH or other type of authorization protection useless. I am proposing this in an event of a physical security compromise (getting your stuff stolen).

Encrypting whole system just slows down whole thing…

This is more of a theoretical than a practical slow down when it comes to modern hardware.

9

I mean that sensitive files in HA would be encrypted, but when a person would login into HA these files would be decrypted, either “per request” (when accessed) or in some other way (by entering a password etc…), while accessing HA via ssh or other external, not permitted way would result in encrypted file. I guess similar as new backup files - they are encrypted, but if you donwload them they are decrypted automatically (if accessed from HA inside, of course).

Hm… not if HA is running on ancient hardware as Pi3 or similar… and there are quite some guys still using such old hardware.

10

Honestly, I work in criminal law on a daily basis.

The average burglar is not after computer equipment except laptops and phones. They won’t take your raspberry pi. If they do, they won’t know what to do with it. It’ll end up in a rubbish bin or in their garage junk pile.

11

This subject seems familiar. Search is your friend :slight_smile:

12

Obviously my argument is not targeted against the average burglar that’ll sell a stolen laptop for a crack. No one doing that will attempt to exfiltrate data sitting in plain text from a storage device which is the example I gave.

Anyway, I think we are going further away than the topic here. I am fully aware that what I am proposing means hundreds if not thousands of man hours and countless technical issues, but I don’t think “don’t worry about it” is one of them. Nowadays almost all consumer devices are ariving in our hands with FDE turned on by default. And if not, the user is somehow encouraged to activate it.

The HA foundation also sells hardware with privacy as a selling point. I fail to understand how encryption at rest will not be counted as an absolute benefit in that matter.

13

At the end (as already said): if someone breaks into my house/system then HA is at the bottom of my worries…

14

Understandable, but irrelevant to the topic. This is HA forum, not home security forum. I’ve seen people here and on reddit using HA as a storage for a security cameras footage, family photos and PII data that shouldn’t be sitting there. Not that FDE will solve the problem of why is such type of data sitting there, but it is yet another layer of protection when the worst happens.

15

Yes, and three out of four types of HA Installations allow that FDE that will solve your problem (not)?.. :wink:

1 Like