WTH - Dangerous/Sensitive actions to need explicit user identification (fingerprint)

Month of "What the heck?!"
1

I know we have “Lock app” which is a “gate all” solution.

However, I still believe we should have sensitive actions to require immediate fingerprint confirmation (configurable).

Examples:

  • Gain physical access to a house by unlocking the Front Door.
  • Disabling the alarm

Where I live it is common for people to have their phones stolen while unlocked, with the intention to transfer money, identity theft, etc. Soon enough someone will realise they can use it to unlock houses. I want to be ahead of the problem.

App Lock can be enabled, but within the session timeout anything is possible. Or you have the app constantly locking, or you are potentially exposed.

I believe we could add one extra type parameter here:

Something like this:

  confirmation:
    text: Are you sure you want to restart?
    type: biometric
    exemptions:
      - user: x9405b8c64ee49bb88c42000e0a9dfa8
      - user: 88bcfbdc39155d16c3b2d09cbf8b0367

Or maybe a boolean require_biometrics to avoid overusing the type field name.

2

Currently, actions can have confirmation pop ups. While this isn’t secure, it does prevent accidental presses of sensitive actions. You can also filter the visibility of certain buttons by user, so only you could have access to the “Disable Alarm” button. If only you can unlock your phone, and only you can see the button, then only you can disarm the alarm.

As for the idea of sensitive actions, Home Assistant can’t really know that out-of-the-box for all users, but it could potentially be user-defined.

The security aspect is similar to the RBAC WTH: WTH no access control - #38 by jrittenh

1 Like
3

This is called “context” in HA speak. And there is a WTH open to request it be made more user friendly. See: WTH There's no "who changed a switch" sensor?

1 Like
4

I think I wasn’t very clear on my explanation. So I added some clarification.

5

Oh, you mean an actual fingerprint reader.

Why not just lock your phone?

6

I covered that on the OP…

People are mugging phones while owners are using them (hence unlocked), with the intention to transfer money, identity theft, etc. Soon enough someone will find out they can use it to get into houses, I want to be ahead of the problem.

We have Lock App, but it is still not good enough IMHO. Or you have an app that is constantly locking in order to achieve this level of security, or you are exposed.

7

I believe we could add one extra type parameter here:

Something like this:

  confirmation:
    text: Are you sure you want to restart?
    type: biometric
    exemptions:
      - user: x9405b8c64ee49bb88c42000e0a9dfa8
      - user: 88bcfbdc39155d16c3b2d09cbf8b0367

Or maybe a boolean require_biometrics to avoid overusing the type field name.