Google Assistant: Add 2FA to doors, locks

[balloob]

Home Assistant release with the issue: 0.91
Last working Home Assistant release (if known): -
Component/platform: Google Assistant
Description of problem:
Request from Google: Anything that can be a security issue should have 2FA in front of it.

https://developers.google.com/actions/smarthome/two-factor-authentication

Two different 2FA formats: confirm and pin needed.

Devices we should protect:

• cover with device_class DEVICE_CLASS_DOOR, DEVICE_CLASS_GARAGE
• locks

[awarecan]

Note: The ackNeeded challenge type is not recommended for security devices and traits.

So we have only one choice, pinNeeded

[awarecan]

We can integrated this with our current MFA module either TOTP or HOTP.

The workflow could be

1. user request open a lock via GA
2. HA received the intent, check if it needs 2FA, if yes, go 3), no go 7)
3. if need, check if current user enabled MFA, if yes, go 4) or 5), if no go 6)
4. if yes, if TOTP configured, e.g. use Google Authenticator, HA do nothing, return pinNeeded to GA
5. if yes, if HOTP configured, HA send one time pass code to configured notify platform, return pinNeeded to GA
6. if no MFA configured, check if PIN configured in entity config entry, if still not, check google_assistant config, if found one, return pinNeeded to GA, if not found anything go 7)
7. if it does not need 2FA, no MFA configured, no pin found, just execute the intent.

After GA ask user the PIN, user get check preconfigured google authenticator, or received the message contains the pin code, then provide the code to GA.

GA then will send the code with intent back to HA, and HA can go through the same logic above to check the if the code is valid.

[awarecan]

I think it maybe a good idea to add 2FA as a general security feature. e.g. if user open front lock from our UI/app, we will ask PIN as well.

[balloob]

I think that that we don't have to be this complicated. I think that we can just allow users to specify a single pin in their config or UI that is required to interact with security devices.

[awarecan]

single PIN for MVP of course, but eventually I think a general security feature is a good enhancement

[balloob]

We shouldn't make it too difficult because it will have to be shared with family.

[MartinHjelmare]

What is the second factor in the pin challenge mechanism? It sounds like one factor to me.

[awarecan]

User have to link their Google account with HA account or Nabu Casa account as first factor.