Core: Google Secure Devices PIN response with Google Home devices

[PhilRW]

Home Assistant release with the issue:
0.92.0

Last working Home Assistant release (if known):
0.91

Operating environment (Hass.io/Docker/Windows/etc.):
Hass.io

Component/platform:
cloud, Google, secure devices PIN

Description of problem:
When I attempt to open my garage door, Google Home (speaker or hub) challenges me for a PIN code. Once I say it, it responds, "My apologies, I don't understand."

Problem-relevant configuration.yaml entries and (fill out even if it seems unimportant):

cloud:
  google_actions:
    filter:
      include_entities:
        - cover.garage
    entity_config:
      cover.garage_door:
        room: Garage
        aliases:
          - garage door
          - garage

Additional information:

This happens when using Google Home devices such as the home hub or mini speakers.

It almost seems like it thinks it's a new query instead of a conversational follow-up.

[ghost]

Hey there @home-assistant/core, mind taking a look at this issue as its been labeled with a integration (cloud) you are listed as a codeowner for? Thanks!

_This is a automatic comment generated by codeowners-mention to help ensure issues and pull requests are seen by the right people._

[balloob]

What garage door are you using? And could you show the state + attributes of that garage door?

CC @cogneato

[PhilRW]

cover:
  platform: opengarage
  covers:
    garage:
      host: 10.0.0.123
      device_key: some_password
      name: Garage Door

state is closed currently
attributes are:

wifi_signal: -63
distance_sensor: 76
door_state: closed
friendly_name: Garage Door
supported_features: 3
device_class: garage

[PhilRW]

Something similar happens with the Google Assistant built into my Android phone. Its response is "Oops, can you try again?" after entering the PIN.

[PhilRW]

My Google account is a G-Suite account, if that matters.

[balloob]

Do you see any errors/warnings in your logs?

And could you turn on debugging and look at the messages that get sent from/to Google.

logger:
  default: info
  logs:
    hass_nabucasa: debug

Also, as a temporary workaround, you can change the device class to window:

homeassistant:
  customize:
    cover.garage:
      device_class: window

Windows don't currently require a pin.

Note for self: Supported features 3 means supporting open and close.

[PhilRW]

No errors in the log, but after turning on debug logging I see this:

2019-04-27 17:25:32 DEBUG (MainThread) [hass_nabucasa.iot] Received message:
{'handler': 'google_actions',
 'msgid': 'fdf1f735-c9bd-43be-a379-ac849ae4721d',
 'payload': {'inputs': [{'context': {'locale_language': 'en'},
                         'intent': 'action.devices.EXECUTE',
                         'payload': {'commands': [{'devices': [{'id': 'cover.garage_door'}],
                                                   'execution': [{'command': 'action.devices.commands.OpenClose',
                                                                  'params': {'openPercent': 100}}]}]}}],
             'requestId': '10588012849296276659'}}

2019-04-27 17:25:32 DEBUG (MainThread) [hass_nabucasa.iot] Publishing message:
{'msgid': 'fdf1f735-c9bd-43be-a379-ac849ae4721d',
 'payload': {'payload': {'agentUserId': '046e56a8-34fc-4987-8f45-c192299a9ca9',
                         'commands': [{'challengeNeeded': {'type': 'pinNeeded'},
                                       'errorCode': 'challengeNeeded',
                                       'ids': ['cover.garage_door'],
                                       'status': 'ERROR'}]},
             'requestId': '10588012849296276659'}}

No messages after I tell it the PIN, however.

[balloob]

okay, in that case it must be an error inside Google, as this is the correct challenge response as per the docs.

The only difference I see is that we add agentUserId, and I will open a PR to make sure that we drop that. It has however not impacted us during testing.

[balloob]

Could you try it with a personal Google account?

[stealth658]

I have the same issue with my personal Google account without using the Nabu Casa cloud service. I’m using an August Smart Lock Pro and Craftsman MyQ garage door both connected to my SmartThings hub. When I give it the code, it says, “Oops, can you try again?” The only related thing I can find in my log is this:

Apr 30 00:35:20 raspberrypi hass[296]: 2019-04-30 00:35:20 DEBUG (MainThread) [homeassistant.core] Bus:Handling <Event google_assistant_command[L]: request_id=5190356680245799737, entity_id=lock.front_door_lock, execution=command=action.devices.commands.LockUnlock, params=lock=False

[cogneato]

I've had some inconsistent behavior with the pin and cover device since first setting it up.
@PhilRW I would try no customization for the entity's device class, and possibly no room set in the cloud: config.
If I say "open the garage _door_" to one of my google homes indoors, I will get "it looks like that device hasn't been set up yet".
If I instead say "open the garage" (I have assigned the device to a room, but within the Home App), I will be asked for the pin, and replying with the pin works.

Oddly, If I'm outside in the car and using Google Assistant on my phone, saying "open/close the garage door" works fine. The pin is requested, I give the pin, it opens or closes.

[PhilRW]

Could you try it with a person Google account?

I can try setting things up with a non-g-suite account but I'll have to set aside a bit of time to do it. Google doesn't make it easy to switch accounts on assistant devices.

@PhilRW I would try no customization for the entity's device class, and possibly no room set in the cloud: config.
If I say "open the garage _door_" to one of my google homes indoors, I will get "it looks like that device hasn't been set up yet".
If I instead say "open the garage" (I have assigned the device to a room, but within the Home App), I will be asked for the pin, and replying with the pin works.

I've had the garage door opening and closing on voice command for quite a while now through Google Assistant; it's the addition of the PIN challenge/response that broke things for me. I'll try removing the entity_config section for the device and see if that helps.

[Whytey]

Just installed a gogogate2. Had a major fail, showing the wife how it works. Google doesn't seem to piece the initial request and the response to the PIN as a single activity.

• Using a GSuite account also, but that shouldn't matter.
• Using Nabu Casa cloud service

Screenshot from my Google account - PIN is just a tester so happy to expose.

[brianjamescarter]

thank you for the workaround about the window @balloob . this has been a frustration for me, the pin does not seem to work, no matter what I try to set it to. same issue as OP

It would have been awesome for google not to require a pin, make it optional... but once again we must be protected by nanny Google.

[parberge]

To me it only works if I talk english. If I try in swedish it asks for pin code, and when I supply it it will just do a google search on the pin code instead of using it 😏

[4ordy]

Thanks for the workaround @balloob.😊
I’m not complaining but it’s not working in HomeKit as a window....wife is not impressed tho😂

I have the personal google account by the way and a diy Mqtt garage opener

I also couldn’t add the secure devices pin back on release 92.1...the Check threw an error
Many thanks

[uphillbattle]

To me it only works if I talk english. If I try in swedish it asks for pin code, and when I supply it it will just do a google search on the pin code instead of using it 😏

Same thing in Norwegian on HA 0.92.2. When I say the pin code, Google Assistant helpfully (not) googles it for me...

Controlling the garage door from Google Assistant worked well until the pin code thing was introduced.

Of course, the pin code thing was meant (I guess) to increase security, which it has since it is now not possible to open the garage door (using Google Assistant). 😉

[4ordy]

Working for me now on 92.2 :)
I'm not sure but I also turned continued conversation on off in GA...it was off previously...not sure if this is required but
Got it working by upgrading to 92.2, turned Continued Conversation on, added pin in config and synced devices..... all good

Thanks

[balloob]

Google has confirmed to me that 2FA for non-English languages does not work yet and will arrive by Q3.

[uphillbattle]

Google has confirmed to me that 2FA for non-English languages does not work yet and will arrive by Q3.

Would it be possible to disable 2FA for non-English languages while we wait for Google to come around? Not very respectful of Google to require 2FA when 2FA is not widely deployed (outside English speaking countries). As it is now, I have to resort to "old fashioned" (key fobs or HA frontend) ways of opening my garage cover.

[balloob]

The OpenClose trait is actually not publicly available and we're accessing an early access preview feature. We can't blame them.

And yes, we will find a way to work with this.

[uphillbattle]

Great! Thanks!

[PhilRW]

No luck for me using continued conversation, removing customizations, or making the cover a window.

[CrackerStealth]

I am also having problems with the needing a pin as of 0.92. Unsure if I should create a separate issue or not as routines are not working as expected for me but interacting with just the individual devices works. I have a "Goodnight" routine that involves locking both the doors in my house and turning all the lights off except for the bedroom. I was prompted to setup a pin after updating to 0.92.2 when saying "Ok Google, Goodnight."

After setting up the PIN and re-syncing all my devices, the next night I tried it again. When saying "Ok Google, Goodnight" it responds normally, but never prompts me for a pin and just ignores locking the doors.

Interacting with the asking Google to lock one door works with pin code. Asking Google to lock all the doors works with pin code.

[DewGew]

Google has confirmed to me that 2FA for non-English languages does not work yet and will arrive by Q3.

Its now Q4 any news on this? :)

[uphillbattle]

I have no idea, but if you sign up for Nabu Casa, you will have the options of opting out 2FA for secure devices.

[svh1985]

Doesn't work in Dutch.
Also, the Google Assistant documentation at https://www.home-assistant.io/integrations/google_assistant/ is not updated, it still states to use allow_unlock in the config.
Ref https://github.com/home-assistant/home-assistant/pull/23223