71
AI bot hacking/scraping Home Assistant (lemmy.world)
submitted 2 days ago by to c/selfhosted@lemmy.world
34 comments fedilink hide all child comments
 

I pay for the Nabu Casa subscription for remote access to Home Assistant. Mostly as a way to give them money for a great service, but it's convenient and felt pretty secure. It should be the only remote way into Home Assistant. About an hour ago I got a login attempt notice that an IP was trying to access API/config. The IP is in some bad IP databases. What I found interesting was that the log shows an AI bot. A Google Gemini bot specifically. Makes me worry that AI is going to make yet another aspect of life frustrating and unfun.

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 1 day ago

If you use a publicly trusted TLS certificate (either directly, or via Nabu Casa offering), domain will be recorded in Certificate Transparency logs.

You can slightly hide it if you use a wildcard domain in the TLS certificate (e.g. *.example.com), and then use a subdomain for the service. Ideally, something that's not home/hass/ha.example.com, or otherwise easily guessable.

  • permalink
  • fedilink
  • source
  • parent