Is HA spying on me?

Hi

I discovered that NetworkManager on my fresh installed system has been configured to make a “connectivity check” every 10 minutes to:

http://checkonline.home-assistant.io/online.txt

Or, deliver a heartbeat to HA’s headquarter?

I don’t remember being told about it, let alone asked for permission to do it, during installation/setup process?
It makes me feel a bit strange…
There is nothing about it in the HA’s docu on NetworkManager.

Any comments, opinions anyone?
Regards,
Chris

What? Only every 10 minutes? Your smartphone does much better! :wink:

You mean, even if you are a bad guy, as long as there are guys worse than you, you are fine?
What a philosophy of life.

Connectivity check

The issue

Home Assistant needs to know when it has a stable network connection in order to disable functionality which requires that. Without this check you will face an increased number of errors and performance issues due to connection timeouts.

The solution

:point_down:

:raised_hands:

1 Like


I think even my neighbours dog is spying on me with binoculars

7 Likes

Ooooh look! He’s bought another Tuya socket.

1 Like

Why people think that they are so important that someone will spend manpower,resources and money on actively spying them was and is always buffing question.
No, no one is spying on you, but some smart devices using cloud for operations are most likely gathering information about your habits. I wouldn’t say that they are actively spying but very likely to probably is gathering information’s for company own purpose.

Daniel
Implying what I’m thinking about myself is not nice.
Moreover, it’s not about importance.
I just like to know what is my computer doing and why, that’s all.

Regards,
Chris

1 Like

Thanks for providing the link, the search function on HA docs website finds nothing about NetworkManager.
Under those aspects, it does in fact make sense to keep track of the Internet connection status.

Regards,
Chris

It never finds anything useful. Use any other search engine (Google, DuckDuckGo, Startpage, etc…). you don’t even need to specify the site to search and they still do a better job.

Like :point_down:

This :point_up: :question:

Easy 180° in one thread, not bad :wink:

I don’t know why you feel offended by my comment.
You can’t skip gathering information or spying or whatever you want to call it if you are using any sort of electronic communications.
This is legal in most if not in all countries around the globe.
This is one small part of electronic communications law roughly translated.

Operators of public communications networks and publicly available electronic communications
services, as well as legal and natural persons, who, on the basis of special regulations,
perform the activity of electronic communications networks and services in the territory
of the Republic of Croatia, must perform this activity and develop and use electronic
communications networks and services in a manner that is not contrary to national
interests in the area of ​​national security, in accordance with the law regulating the
security and intelligence system of the Republic of Croatia, and must ensure and maintain,
at their own expense, the function of secret surveillance of electronic communications
networks and services, as well as electronic communications lines to the
operational-technical body competent for the activation and management of the measure
of secret surveillance of electronic communications.

No one will ask you for permission not even tell you that your activity will be monitored.
If you don’t agree with it you don’t have to use any electronic communication and live free of the grid.

So to summarize, we establised:

  • HA pings home 24/7, 6 times per hour
  • Nabu Casa burried the info in the docs by implementing bad search
  • The Republic of Croatia can monitor this data at their will

From this, both Nabu Casa and the Republic of Croatia will:

  • know you use HA
  • Guess you updated the first wednesday of the month because you missed one ping.

Did I miss anything else?

EDIT: Oops, I missed one: it will be on the top of your list of DNS request to investigate because it happens so much.

3 Likes

No. I just paste this to show him that spying is and will be done by the state if they want. And they will be first in line. And then every body else.
This act is aligned with eu regulation so it is at least like that all across eu.

Help me understand:

Are you upset about a network manager doing networking things?

What is the harm in this particular mechanism?

Do you have any direct evidence of spying?

Some of the comments in this thread are rather disappointing, especially since the front page of this website claims:

"Open source home automation that puts local control and privacy first. "

This post is probably just going to cause more arguments, but for the few honestly wondering what concerns can/should be, here are some additional thoughts.

Many of us have chosen Home Assistant to give us this control, for both privacy and security reasons.

From a privacy perspective (I’m not even touching the Nothing-to-hide fallacy), Home Assistant is more chatty than it should be. This thread is a great example, and then there’s the ‘feature’ where Home Assistant overrides local DNS preferences and using Google/Cloudflare for DNS queries, which has its own privacy implications (How do I stop Home Assistant from trying to bypass my local DNS? - #3 by vitaprimo old thread, but still an existing behavior). IF Network Manager really needs to know I’m connected to the internet, despite not using any cloud-dependent components and having all analytics reporting features disabled, then it should at least prompt and/or allow you to change these parameters.

It’s also extremely disappointing when applications don’t fail gracefully because they can’t handle a failed connection properly. Home Assistant falls in this category according to their own instructions, so now I’m losing this tiny bit of control unless I’m willing to forcefully remove this behavior via unsupported code changes.

This could even pose a security risk. Here we have a system which may have any form of updates and analytics disabled, but is still pulling down a file on a very regular basis. Imagine a Log4Shell-like scenario, maybe in curl or whatever library it uses, where just the act of Network Manager downloading this file would compromise your system. Now all a malicious actor has to do is compromise/redirect this file, and now every single instance is compromised. Domains expire (sometimes by accident), DNS infrastructure gets hijacked, it happens.

So is a state actor trying to spy on you? Is Nabu Casa trying to spy on you? Most likely not. But I strongly encourage everyone to do their own research, assess which values matter most to you, and not look down on people who are attempting to answer these questions for themselves, it’s what makes products such as Home Assistant better.

That’s all.

1 Like

I did some research and statistically every one in this thread (beside me) uses a mobile device with apple or google OS giving away their privacy freely :put_litter_in_its_place:

You completely missed the point of my post.

I don’t think so. Just wanted to point out that about 99%+ of the people actually don’t give much (any?) thought and prefer easy/quick solutions. They are not concerned the slightest giving away private informations of their own and getting tracked and targeted. The phone which most people carry around all day long is just such a great example for this as literally everyone has this always on trackers in their pockets :satellite:

I even guess most HA users are not spending much time on the privacy topic at all and choose HA just because it is the “market leader” or most advanced/flexible solution. The vast majority probably uses cloud services and their ISP provided DNS… It’s just the fast track and the other ones (like you and me and the other 0.0001%) are wearing tinfoil hats :cowboy_hat_face:

I’m not sure why there’s so much negativity in this thread. In general, my solution to this is to configure iptables. If you really want to control what software does then you put it on a dedicated network. On HA you can configure iptables to restrict it.

I do the same for untrusted smart devices: put them on a dedicated network which is isolated from the internet and allow only specific connections.

Not really a solution to your specific problem but here’s some notes I have for myself for configuring a firewall if you’d like to get started somewhere. blog/_drafts/linux-firewall-primer.md at 7fa6a35508393a8e3fd414ae16fceaf0491b4192 · samrocketman/blog · GitHub

1 Like