I pay for the Nabu Casa subscription for remote access to Home Assistant. Mostly as a way to give them money for a great service, but it’s convenient and felt pretty secure. It should be the only remote way into Home Assistant. About an hour ago I got a login attempt notice that an IP was trying to access API/config. The IP is in some bad IP databases. What I found interesting was that the log shows an AI bot. A Google Gemini bot specifically. Makes me worry that AI is going to make yet another aspect of life frustrating and unfun.
If you use a publicly trusted TLS certificate (either directly, or via Nabu Casa offering), domain will be recorded in Certificate Transparency logs.
You can slightly hide it if you use a wildcard domain in the TLS certificate (e.g.
*.example.com), and then use a subdomain for the service. Ideally, something that’s nothome/hass/ha.example.com, or otherwise easily guessable.