Other reputational risks come from not giving users choices over their own installs.
More risks again from nagging users who don’t administrate the HA install to change something that they can’t.
It is possible to do this without the expense of annoying users, and that is accomplished by allowing a simple choice to disable the warning (at a back-end config if casual disabling is to be avoided).
It’s a good idea to have a strong password reminder built-in, it is also a good idea to allow HA system admins choose what warnings users see.
Another aspect of this is if nagging people to choose good passwords was going to work it would have worked already over the last 30 years we’ve been trying it but that moves away from the issue here.
What’s being asked for is a simple way to disable a legitimate warning after it has been seen. It’s not a big ask, it can be made ‘power user’ only by allowing deactivation via yaml only.
I remember how long it took to get the bogus ‘unauthorised access’ messages disabled, and I hope it’s not the same in this case.
I also think this thread should be locked, as it appears to have descended into vague insults over a simple config toggle.
Sure, but does the car remind you that you didn’t drive it very well in the past every time you open the door?
I agree with Bit-River. We’re just going in circles now. Let’s lock this thread.
I accept that in an ideal world I’d have chosen a strong password with a mix of lower case and upper case and 3 symbols and used a password manager.
I didn’t and I knew the risks when I chose not to.
HA is now telling me it’s a risk. It’s a nice feature, but I should be able to ‘dismiss’ it without it coming back every hour until I redesign my system.
It reminds me if I’ve left the door open, not put my seatbelt on, let my tires go flat, not topped up the screenwash, left my lights on, left my keys in, etc etc etc.
Car manufacturers make the noise of the ‘no seatbelt’ warning intentionally annoying so that you put it on. They don’t offer a button to stop that warning.
Doesn’t matter how good of a driver you think you are, or how much you think you don’t need to wear a seatbelt.
The minority will the seatbelt up behind them to stop the warning (those adding an auto-dismiss), but the majority will do the right thing and just put the seatbelt on.
And I bet that is what Home Assistant devs are aiming for.
I would argue that most people put the seatbelt on because they actually see a risk.
In this case the risk is not there, at least that is what some argue.
Those who do not put seatbelts on probably won’t say there is no risk.
My opinion about the strong passwords, is that I’m fine they tell me if I’m using a weak or strong password like some pages do.
But I hate when they force me to use some predefined pattern since it generally only result in “password.12” or something similar.
Just looking at my messages on Teams every day displays that this is how people do when they are forced to a pattern.
Teams starts up automatically and the last used group chat is selected by default, it generally opens about the same time as people are going to sign in to their management accounts so you get messages every day with “food.2021” where “food” is part of the company name. The first few characters are placed in the correct window the rest in the open chat.
Definitely beginning to regret the car analogy now! Sorry!!
Sure beep endlessly if I’m not wearing a seatbelt until I put it on, but this is the equivalent of beeping endlessly at me when the fuel’s low until I find a gas station.
If you were taking that car (homeassistant) off the road (internet) and using it on a private race track (your LAN) then you might remove the stock seats and seatbelts (passwords) completely and use bucket seats and a five-point harness (your firewall), at which point the constant bing-bong (the warning being discussed in this thread) would be annoying and you would mute it.
Muting the warning when someone knows what they are doing is all that is being suggested.
For the record, I have fairly easy passwords on my LAN. And complicated/random passwords for internet stuff. That’s not to say I shouldn’t think about changing them though.
Maybe there should be an option to snooze it for a set period?
I’m floored that anyone would think it’s HA’s job to be my Password Nanny.
HA wasn’t created to preach anyone’s particular opinion about how passwords “should” be managed in our home networks, or on third-party systems that HA may need to access.
I can’t believe there’s even any debate. Sure, warn the newbies about a potential security vulnerability. Then let the system administrator - us - decide what to do about it.
But nag us every day? That’s beyond absurd, and suggests something about the character of any developer who would think that’s OK.
I don’t care what guaranties are given by K-Anonymity. Sending any data to third party without my permission, particularly (albeit coded) password details, is not on! We need a way to disable this.
If I run a car in a closed confined space (my private area). I basically can legally dismantle just about anything from that car. It’s up to me how I want to operate it.
It seems that the longer HA moves forward the more this concept seems to get trampled on.
Seriously?
Not every implementation of Iot devices allows over the air updates.
And not every OTA update finishes successfully.
In either of those situations you will then need to “dismantle” something (even if it’s just taking off the wall plate for your switch to gain access to the device).
And it was all forced on someone who kept getting nagged to update a password when there was no reason to be concerned in the first place. Or if there was a reason the person actually used their autonomy to decide to do it anyway.
But…
Is this only affecting supervised installs? Makes me wonder based on this:
Anyone who have security cameras/alarm and locks hooked up, should check their terms & conditions. There is a significant risk that their insurance will be voided due to sending password data to a third party provider.
