Comment on AI bot hacking/scraping Home Assistant
4am@lemmy.zip 1 day ago
I’ve got Nabu Casa and IPs from the “googleusercontent.com” domain have been hitting my instance about once per day for the last week or so.
Use strong passwords and let’s hope that the login page doesn’t have any vulnerabilities…
Home assistant also supports mTLS.
home assistant is something you’d likely ever want to allow from a handful of trusted devices, so deploying a client certificate on them can make sense.
This way a non-onboarded device doesn’t even get to the html part, it’s denied upstream by a reverse proxy before HA is involved.
captcha_incorrect@lemmy.world 23 hours ago
I follow a guide for authelia and caddy, making it so that I can put authelia infront of anything without it the service behind supporting it. Still have to authenticate on the service behind but that is a small inconvenience.