Saving Amazon password in HA - Security concern

[iffihyd]

I am new to HA and I wanted to install HACS with alexa media player integration. I am worried to save my amazon password in HA. how secure is the email and password of amazon stored when setting up Alexa integration of HACS

[alandtse]

It's stored where HA stores passwords. The security of that is the same as any other passwords/secrets you store in HA. HA should have a couple of threads talking about the risks of that method.

EDIT: For an HA link.

[jquiros2]

Bummer. Any other password/secrets I share with HA are not as much of a worry. Amazon account is, especially without needing 2FA, so now looking into what this is about.

[alandtse]

We actually ask everyone to enable 2FA for this reason among others.

[bbrummer]

But you're saving the 2FA key in the raw, which effectively makes the entire exercise pointless.

The ONLY way this should be done if it's done at all is with a hardware 2FA like a USB Fido2 device or similar (For example, Yubikey). At least with a hardware 2FA plugged into USB a hacker would have to issue all their Amazon requests directly from your HA instance, they couldn't just copy the key and walk off.

Frankly there's got to be some way to manage an integration like this w/o needing Amazon credentials. Why can't this just go through a Skill??

[alandtse]

Valid points. No one is forced to use the Built in 2FA key but perhaps someone could edit the wiki to warn about that.

Happy to take a PR if you can figure it out a better way. I'm not aware of the Skills API allowing any of the api calls we use though so you'd have to investigate if there are equivalent ones.

[bbrummer]

I'm going to take a look first into offloading 2FA to a hardware key.

Looking around Amazon is remarkably unhelpful here. My first thought was to make a dummy Amazon account (no stored billing info, no AWS, etc) and just add it to my Household for Alexa. That would probably work fine if I was single....but Households only allow 2 "adults" and my wife takes that second slot. I don't think "teen" accounts will work, but I'm going to try.

I'm also taking this as an opportunity to finally take the Alexa SDK out for a solid test drive and see what's possible. I know they used to be annoyingly restrictive on un-prompted "announcements", not sure if that's still the case? My GE washing machine can happily spam "Laundry is done!" out all my Echos so something must have changed.

[jquiros2]

I just tried creating another amazon account (teen) in my household just for this, thinking I could give that user access to, and only to, my echo devices. But no good, so far. Like bbrummer, also married and other adult slot is taken :-)

This is because my main amazon account is the root of many aws services we have running, and I just can't let aws creds to be sitting in HA.

Ideally, amazon would have a way to create access permissions/tokens with limited scope, much like google does with OAuth.

Will check into this- maybe in the aws side of things...

Started getting into "Alexa for business" thinking I could create an IAM user specifically for this, but things got a little complicated.