Following up on the discussion in #95032 – it would be great to have an option in the ESPHome integration to treat some devices as “untrusted” and disable their ability to make arbitrary service calls into the connected HA instance via homeassistant.service.
The fact that there is currently no way to disable this functionality (devices triggering services back in HA) creates a security vulnerability where an ESPHome device in a location that is not physically secure (e.g. a sensor or switch located outside the house) can be used to effectively take over the parent HA instance, and open house locks, disable alarms, etc.
This situation is quite surprising (intuitively, communication with a sensor should be one way) and it undermines common security practices, like having strong HA passwords, and isolating untrusted devices to a vlan/subnet that is not able to initiate connections to the outside world.
But hold on, the device outside the house would need to be physically connected to a computer to be flashed, and someone would need your API key to connect it to your home assistant, not to mention needing access to the HA UI to connect it.
It has to be or you would have to manually enter it every time the device starts up to get the api connection working.
Even if it was only stored in memory and you did have to enter it via a serial cable every time the device started, it could be extracted from memory when the device is running with the right tools.