59
AI bot hacking/scraping Home Assistant (lemmy.world)
submitted 1 day ago by to c/selfhosted@lemmy.world
32 comments fedilink hide all child comments
 

I pay for the Nabu Casa subscription for remote access to Home Assistant. Mostly as a way to give them money for a great service, but it's convenient and felt pretty secure. It should be the only remote way into Home Assistant. About an hour ago I got a login attempt notice that an IP was trying to access API/config. The IP is in some bad IP databases. What I found interesting was that the log shows an AI bot. A Google Gemini bot specifically. Makes me worry that AI is going to make yet another aspect of life frustrating and unfun.

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 19 hours ago (1 child)

and let’s hope that the login page doesn’t have any vulnerabilities…

Home assistant also supports mTLS.
home assistant is something you'd likely ever want to allow from a handful of trusted devices, so deploying a client certificate on them can make sense.
This way a non-onboarded device doesn't even get to the html part, it's denied upstream by a reverse proxy before HA is involved.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 5 points 17 hours ago

    I follow a guide for authelia and caddy, making it so that I can put authelia infront of anything without it the service behind supporting it. Still have to authenticate on the service behind but that is a small inconvenience.

  • permalink
  • fedilink
  • source
  • parent