This is an across the board.password check. It’s unreasonable to expect different rules for each possible integration. If you need to dismantle stuff to change passwords then you’ve not designed it very well
Thanks. That’s really helpful.
Also, I crashed my car when I was 19. Perhaps you can tell me I wasn’t driving very well?
6 Likes
Other reputational risks come from not giving users choices over their own installs.
More risks again from nagging users who don’t administrate the HA install to change something that they can’t.
It is possible to do this without the expense of annoying users, and that is accomplished by allowing a simple choice to disable the warning (at a back-end config if casual disabling is to be avoided).
It’s a good idea to have a strong password reminder built-in, it is also a good idea to allow HA system admins choose what warnings users see.
Another aspect of this is if nagging people to choose good passwords was going to work it would have worked already over the last 30 years we’ve been trying it but that moves away from the issue here.
What’s being asked for is a simple way to disable a legitimate warning after it has been seen. It’s not a big ask, it can be made ‘power user’ only by allowing deactivation via yaml only.
I remember how long it took to get the bogus ‘unauthorised access’ messages disabled, and I hope it’s not the same in this case.
I also think this thread should be locked, as it appears to have descended into vague insults over a simple config toggle.
12 Likes
Same here. I was. Doesn’t mean I don’t see the need to drive well now
Sure, but does the car remind you that you didn’t drive it very well in the past every time you open the door?
I agree with Bit-River. We’re just going in circles now. Let’s lock this thread.
I accept that in an ideal world I’d have chosen a strong password with a mix of lower case and upper case and 3 symbols and used a password manager.
I didn’t and I knew the risks when I chose not to.
HA is now telling me it’s a risk. It’s a nice feature, but I should be able to ‘dismiss’ it without it coming back every hour until I redesign my system.
3 Likes
I don’t understand the discussion .
It’s Home Assistant, so automate it.
Thanks @jaaem for the automation.
I modified it a bit to rule all pwned notifications.
- alias: persistent_notification_clear_pwned
mode: parallel
trigger:
- platform: event
event_type: call_service
event_data:
domain: persistent_notification
service: create
condition:
- condition: template
value_template: >
{{ 'supervisor_issue_pwned' in trigger.event.data.service_data.notification_id }}
action:
- service: persistent_notification.dismiss
data:
notification_id: >
{{ trigger.event.data.service_data.notification_id }}
# Remove this after testing :-)
- service: persistent_notification.create
data:
title: Dismissed notification
message: >
{{ trigger.event.data.service_data.notification_id }}
27 Likes
It reminds me if I’ve left the door open, not put my seatbelt on, let my tires go flat, not topped up the screenwash, left my lights on, left my keys in, etc etc etc.
I rest my case. Your car controls you! 
Car manufacturers make the noise of the ‘no seatbelt’ warning intentionally annoying so that you put it on. They don’t offer a button to stop that warning.
Doesn’t matter how good of a driver you think you are, or how much you think you don’t need to wear a seatbelt.
The minority will the seatbelt up behind them to stop the warning (those adding an auto-dismiss), but the majority will do the right thing and just put the seatbelt on.
And I bet that is what Home Assistant devs are aiming for.
1 Like
I would argue that most people put the seatbelt on because they actually see a risk.
In this case the risk is not there, at least that is what some argue.
Those who do not put seatbelts on probably won’t say there is no risk.
My opinion about the strong passwords, is that I’m fine they tell me if I’m using a weak or strong password like some pages do.
But I hate when they force me to use some predefined pattern since it generally only result in “password.12” or something similar.
Just looking at my messages on Teams every day displays that this is how people do when they are forced to a pattern.
Teams starts up automatically and the last used group chat is selected by default, it generally opens about the same time as people are going to sign in to their management accounts so you get messages every day with “food.2021” where “food” is part of the company name. The first few characters are placed in the correct window the rest in the open chat.
Like this guy:
Or this one:
So when you force people, they fight back.
4 Likes
Definitely beginning to regret the car analogy now! Sorry!!
Sure beep endlessly if I’m not wearing a seatbelt until I put it on, but this is the equivalent of beeping endlessly at me when the fuel’s low until I find a gas station.
1 Like
But they dont beep endlessly do they? They beep for a few minutes and then stop. This same option to stop the nagging should be afforded in HA.
5 Likes
… To add to the car analogy…
If you were taking that car (homeassistant) off the road (internet) and using it on a private race track (your LAN) then you might remove the stock seats and seatbelts (passwords) completely and use bucket seats and a five-point harness (your firewall), at which point the constant bing-bong (the warning being discussed in this thread) would be annoying and you would mute it.
Muting the warning when someone knows what they are doing is all that is being suggested.
17 Likes
I just love an analogy.
I also love reading all of the other analogies!
For the record, I have fairly easy passwords on my LAN. And complicated/random passwords for internet stuff. That’s not to say I shouldn’t think about changing them though.
Maybe there should be an option to snooze it for a set period?
It’s a perception thing with me. I use HA to control my stuff. I am not amused with my stuff (HA) trying to control me.
21 Likes
It should only warn when installing a new integration or add-on.
12 Likes
I’m floored that anyone would think it’s HA’s job to be my Password Nanny.
HA wasn’t created to preach anyone’s particular opinion about how passwords “should” be managed in our home networks, or on third-party systems that HA may need to access.
I can’t believe there’s even any debate. Sure, warn the newbies about a potential security vulnerability. Then let the system administrator - us - decide what to do about it.
But nag us every day? That’s beyond absurd, and suggests something about the character of any developer who would think that’s OK.
22 Likes
I don’t care what guaranties are given by K-Anonymity. Sending any data to third party without my permission, particularly (albeit coded) password details, is not on! We need a way to disable this.
27 Likes
The car analogy is great.
If I run a car in a closed confined space (my private area). I basically can legally dismantle just about anything from that car. It’s up to me how I want to operate it.
I’ve blocked my HA from internet now.
Probably look into either the source code or so, to block the recipient of data.
3 Likes