Hi All, I would also like to disable the new login screen.
I am running the Nginx reverse proxy and facing the same issue where I can see user names even from outside of my network.
Is there any way to disable new login page or modify my proxy configuration to avoid this issue.
Thanks
I have added
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
to my Nginx Proxy configuration, which solved the issue.
Looks like users are disclosed as well simply if the client is on any private address range and HA is on any other private address range.
Even when passing the X-Forwarded-For header to HA behind a proxy (which Caddy does by default) the users are listed.
If I navigate to the HA webpage without any cookies from a class C private subnet on my LAN to the other class C private subnet where HA is, the users are listed. I don’t have any trusted networks set.
There’s a Github issue already to manually disable this new feature.
Well the Github issue was closed since it’s “not an issue”, not really true in this case imo.
This is a serious security flaw that should not even be considered to be auto opt-in, let alone to not have a way to disable it.
I for sure was not waiting for this “feature”
Can’t believe that such a clear security problem is being dismissed. Imagine an attacker navigating to your HA instance and getting a nice listing of all the users.
I have opened a feature request: Login method: select from legacy or new
Please upvote so we can get this done ASAP.
This is not a feature request. This is a MAJOR security issue. That this flagrant flaw in security is “only” in the internal network is not up for debate. Internal network security issues are well-known to be the most exploited and underestimated issues. UNBELIEVABLE we have to put up with this mandatory security reduction. And even more blatant is the fact that this is packaged as a “beautiful new login page”.
The login page should be even more anonymized that the fact that it is a home-assistant page is not even visible.
I cant belive this, just discovered this issue on my setup. Its concerning security practice.
This change need to be reverted asap, in worst case it should have been opt-in
By the way, here’s the branch that introduced the new login screen. It was merged on 11/24. Unfortunately there’s no discussion on the security implications.
Extend auth/providers endpoint and add /api/person/list endpoint for local ip requests #103906
The github issue is marked as too heated because the home assistant team having a lack of arguments
Yeap, saw that coming. Users’ arguments are technically indisputable, but Nabu Casa chooses to shut them down instead of addressing them.
Can’t believe that they don’t a see a problem with HA considering the whole IPv4 and IPv6 private address space (2^64 addresses) “trusted”.
Ive just about had it with home-assistant.
You know, its puzzling how it seems the HA devs dont concentrate on fixing actual issues such as user permission ACL’s, to be able to control which users see the Godforsaken Logbook and History, yet here they are sitting thinking…how can i fuck up the next version of Home Assistant to make it even less secure.
Did anyone even ask you for this stupid useless and bad “feature”?
I must congratulate you though, you did a good job exposing ALL home-assistant instance users globally and made it much easier for a nice brute-force automated attack.
The best part is when YOUR USERS open an issue and express their concerns (and its not their concerns, its actually a slap-in-your-face global security concern), you go ahead and lock the conversation on Github because “too heated”, but you dont have the decency to reply to the community and fix the problem by giving the user a choice on whether to disable or enable this? because yes this is a big problem.
Guys this is what Home-Assistant (Nabu Casa) promises you “their user”.
1stly, Stop claiming that you are focusing on privacy, because you are clearly not.
2ndly, Stop claiming that you are making Home-Assistant better, because you are not.
3rdly, If you claim you have only your users(and no investors), then respect them and their opinions. Otherwise grab this software, make it closed source and be on your merry way to doing what you want since that is what you do anyway.
What else can I said that hasn’t been said? To summarize the other threads:
The issue:
Nabu Casa’s response:
Mitigations:
“exposing ALL home-assistant instance users globally”
Where are you getting this from?
Is it technically so hard to give the option to be able to choose one of two login methods?
It could be implemented in a relatively short time. But we haven’t been told whether they are considering it.
You can understand that whoever updates to this latest release-202312 automatically have all their users exposed in their LAN and you can assume that most (if not all) people use a proxy, they automatically get all their users exposed to the outside world.
It seems that something might have been done about this here yesterday: Add option for exposing users on local networks by edenhaus · Pull Request #105545 · home-assistant/core · GitHub
But then again they made this option to default TRUE (which should logically from a security standpoint be defaulted to FALSE). Ridiculous.
Wait, this is good news. Ok, they will add an option to disable the public user list.
So in your view almost everyone is using a reverse proxy, and the majority of those have it configured in a way that does not pass the origin ip through to Home Assistant correctly, likely ignoring the inclusion of the X-Forwarded-For header and possibly other headers. They connect from outside their network, and they appear to HA to be connecting from a device inside their network.
Ignoring the local login page, how could that best be addressed?
