New (and Free!) Home Assistant Remote Access - Looking For Beta Testers reddit / selfhosted ---------------------------------------------------------------------- Homeway-dev · 2023-12-20 20:46 Hello! I'm looking for beta testers for a new project I'm working on to provide free, secure, and private remote access to Home Assistant - with Alexa and Google Home support! It's called [Homeway.io](https://homeway.io/?source=reddit_selfhost) 🚀 **I want to put this upfront.** I know privacy and security are essential to this subreddit, and they're very important to me as well. **Homeway has a very strong** [privacy](https://learn.homeway.io/privacy/) **and** [security](https://learn.homeway.io/security) **commitment; we will never sell, store, or give away your data.** Homeway tunnels your data from your browser to your Home Assistant and back, then it's deleted. All your data stays locally in your home; I'm just building a secure way to access it. I have written an [extensive page describing Homway's system security](https://learn.homeway.io/security); I would love feedback and scrutiny! I'm looking for anyone who wants to give Homeway a try and provide feedback. If you're interested, [follow this link to get started.](https://homeway.io/getstarted?source=reddit_selfhost) The setup only takes about 20 seconds and should be super easy. **As a** **special thanks, for a time-limited,** anyone who tires Homeway and sends feedback (good or bad), will be getting Supporter Perks for life, which means you get free and unlimited access for life. The point of Homeway is to benefit the community, so I really want to hear all feedback, good, bad, and ugly. # FAQ: **Didn't I see those post on Monday?** Yes, you did. :) I failed to see the subreddit rule about posting information **related** to self-hosted projects only on Wednesday, so the other post was taken down. (sorry about that mods!) **Why are you making a Home Assistant remote access solution?** Good question! I have two main motivations: 1. I want to create a system that's extremely easy to set up, but is also 100% secure and requires no maintenance. I have been in the software and security space for 10 years and have seen countless data leaks and exploits due to user-configured systems that were 99% correct but 1% wrong. Most other systems also require overhead maintenance to keep them up and running. **My goal with Homeway is to have an easy, secure, private, and no-fuss remote access solution!** 2. Nabu Casa is a great remote access option, but it has a security model some users might not like. To be brief, Nuba Casa exposes your local Home Assistant to the public internet and relies on the hardening of Home Assistant and your user account to keep it secure. In general, most security experts advise against exposing anything on your home LAN directly to the internet; it's possible for bad actors to brute force your password, exploit a security issue in Home Assistant, or exploit security issues in any Python libs that Home Assitant uses. You can [search Bing and find hundreds of Home Assistant instances you can try to log into](https://www.bing.com/search?q=site%3Aui.nabu.casa&first=2). I created Homeway to give users another choice in security models. **Homeway doesn't expose your Home Assistant to the public internet at all.** Homeway's security model has two layers of security: your Homeway account and your Home Assitant account. To get remote access, you must be logged into your Homeway account. Homeway has advanced account protections like code-based 2-factor login, 3rd party login providers, and email-based code challenges whenever you try to log in from new IP. Once you have remote access, there's a second layer of security; you must log in to your Home Assitant account. You must log into your Home Assistant, which will create a user session on your browser, just as it would if you were at home. Homeway doesn't store any of your data, including login credentials, session info, or anything. Thus, Homeway has no access to your Home Assistant instance. For full details on Homeway's entire end-to-end security, see this post. ​ **Free Remove Access? How Is That Possible?** Since I aim to ensure Home Assistant users have secure access, I want Homeway to be as accessible as possible. Thus, it must be super easy to set up and, ideally, free. So Homeway will have 100% free remote access, but there will be limits to keep our hosting costs in line. I have a "[project supporter](https://homeway.io/supporter?soruce=reddit_selfhost)" model setup for Homeway, where a user can optionally pay **$2.49/month**. Since you help support the project, you get Supporter Perks! With Supporter Perks, you get unlimited remote access, along with Alexa and Google Assistant support. Ideally, I would like to make the Alexa and Google Assistant support free, so users can also have a secure way to use them, but the services are quite intensive on the Homeway backend. Thus, they are only available to those who support the project. **Homeway will never sell or share your private data to fund the project or for any other reason.** If the Homeway model can't work financially through project supporters, I will shut it down. ​ **What about Nabu Casa?** My goal with Homeway is not to undermine Nabu Casa or Home Assitant. I have talked with the Home Assistant founder and told him to let me know if there's any impact on their services, and we will figure out a solution. In the most extreme case, I will just shut down Homeway. I don't think Homeway poses a threat to Nabu Casa, since they are deeply integrated into all versions of Home Assistant. My goal with Homeway is to provide another security choice for remote access, everyone can pick the solution that's best for them. ​ **What about other remote access solutions?** There are a ton of great ways to get remote access to Home Assistant! CloudFlare tunnels, TailScale, VPNs, and more. If you're the kind of user who can set up that system and use it securely, they are a great option for you. My goal with Homeway is to provide secure remote access for everyone else. That includes users who can't set up another remote access solution or who don't want to fuss with keeping it maintained. ​ # The End I'm excited to get some users into my project and see what you all think! I'm more than happy to answer any questions; fire away! 🥰 ---------------------------------------------------------------------- Homeway-dev · 2023-12-20 21:11 If anyone has any questions, I’m an open book, please feel free to ask! ---------------------------------------------------------------------- TerminalFoo · 2023-12-20 21:17 Didn’t you use a different Reddit account before? ---------------------------------------------------------------------- Homeway-dev · 2023-12-20 21:20 Good catch! Yes, I was using my main Reddit account /u/quinbd, but I wanted to make an official Reddit account for the project along with an official subreddit. (/r/homeway) I thought it would give users more confidence in the validity of the answers if they came from a more official looking account and not just some guy. 😂 ---------------------------------------------------------------------- hairyfred · 2023-12-20 21:23 Would you ever plan to open source the project (even partially) or/and have third party security audits? I doubt open sourcing it would be due to how the service is offered, but having some sort of third party audit would help build trust with the security and integrity of the platform. Either way more options for users who are less confident on how to expose their services is always a good thing :) ---------------------------------------------------------------------- ericesev · 2023-12-20 21:25 I'd suggest clarifying this is not end-to-end encrypted (browser-to- HA) in the same way that Nabu Casa, TailScale, VPNs, and local reverse proxies are. A comparison would be helpful. ---------------------------------------------------------------------- Homeway-dev · 2023-12-20 21:28 That’s a great point. I would be very open to a 3rd party audit of some kind, I thought about it as well. The problem is I don’t know of any service or people who do that for smaller projects, if anyone knows any, please let me know! Currently the add-on and protocol are open source, but the server isn’t. I want to open source it ASAP, but my goal was to roll out the project and see if it had legs before doing a lot of work on it. Right now the server assumes it’s part of the world wide network, so it can run on its own. ---------------------------------------------------------------------- BitterCalendarNow · 2023-12-20 21:28 Interesting alt tunnel idea... I might take a look. ---------------------------------------------------------------------- hairyfred · 2023-12-20 21:28 Just noticed you can't view the guide without setting up an account, the full setup instructions shouldn't be behind a login so users know fully what they are doing and can decide if its right for them before signing up :) ---------------------------------------------------------------------- hairyfred · 2023-12-20 21:33 Might be worth adding linking to the stuff that is opened source on the site (unless I'm blind and missed it) ---------------------------------------------------------------------- Homeway-dev · 2023-12-20 21:33 Please do! I would love to hear your feedback, good, bad, and the ugly! ---------------------------------------------------------------------- hairyfred · 2023-12-20 21:37 I've found instructions on the add-on repo https://github.com/homewayio/AddOn , but should still be easily available on the site without needing to login ---------------------------------------------------------------------- Homeway-dev · 2023-12-20 21:45 Yes! That's an excellent point. I forgot to include that when I revised the post. End-to-end encryption isn't possible due to the second layer of security. The Homeway server has to terminate the TLS connection so it can read your Homeway user session credentials to make sure it should allow you remote access. So your data is fully encrypted from your Home Assistant to the server, decrypted and moved to the http response, and fully encrypted back to your browser. We have a strong security commitment at Homeway that we will not store, keep, or share your data in any way. Once it's tuned, it's deleted immediately. You do have to trust that, but it's also worth pointing out for Nabu Casa, since they control the server, you have to trust they don't create an SSL cert and start terminating the traffic on their servers, which will give them access to it. I'm sure they would never do that, but I want to point out there's always a degree of trust that needs to be placed. As for adding end-to-end encryption in the future, I have thought about it a lot, but haven't come up with a solution yet. There could be some kind of short-term IP white list that's used to allow remote access that would be end-to-end encrypted, but then you wouldn't have true remote access security. If anyone has any ideas, I would love to hear them! ---------------------------------------------------------------------- [deleted] · 2023-12-20 21:51 [removed] ---------------------------------------------------------------------- [deleted] · 2023-12-20 21:53 [removed] ---------------------------------------------------------------------- stappersg · 2023-12-20 21:55 I would like to see a drawing / picture / schematic with the various compoments. Currently I have this incomplete picture ( in ASCII art ): ``` +----------------+ +------+ +------+ | me on the road |---| MITM |---| Home | +----------------+ +------+ +------+ ``` And I wonder why I should want a man in the middle? ---------------------------------------------------------------------- [deleted] · 2023-12-20 22:03 [removed] ---------------------------------------------------------------------- Spohevoli · 2023-12-20 22:19 Is this new account gone as well? ---------------------------------------------------------------------- [deleted] · 2023-12-20 22:35 [removed] ---------------------------------------------------------------------- TerminalFoo · 2023-12-20 23:25 Looks like it’s gone. Can’t even view the comment history.