As Craig has mentioned, I have a more than passing interest in security. I also work with critical national infrastructure and in that capacity get to see threats that most people fail to recognise (don't get me started on Moscow hotels!).
The threats on mobile devices (including laptops) are far higher than most people realise.
But I've made my point and as you say, each person has to recognise and respond to their own threats and risks. I just wouldn't be comfortable if I didn't outline some unexpected threats and risks when I know about them.
Whether NGROK scores highly as a security tool isn't what is at stake here. I wouldn't ever use it in a professional capacity. But because it is turned off for all but the tiniest period, the risk is virtually zero. When active and configured as I recommend elsewhere, it is perfectly adequate for any home automation use.
Node-RED could indeed start/stop a different VPN assuming that Node-RED has sufficient admin rights. One of the differences here is that a VPN would run typically as a system service on either your router or your Node-RED server. Node-RED should NOT have the ability to change its running status as that would itself be dangerous. NGROK however can be run in user space as the same user as Node-RED. Since it doesn't need to run all the time. That also limits what it has access to which is an added benefit (as long as you aren't trying to change things that need root access of course - there are ways round that if you need to).
Nothing other than they would have to know how to do it and the command isn't listed so as long as you haven't done it recently, it wouldn't be visible.
In addition, on a mobile device, the Telegram client app is itself reasonably secure so malware compromise is unlikely.
We aren't trying to make a perfect system here (hint: as you probably already know, such a thing doesn't exist). But we are trying to reduce the potential attack surfaces and make any attacks too much to be bothered with.
More importantly, we are trying to make sure that we reduce the opportunity for US to mess up our configurations, so leaving ourselves vulnerable when we think we are secure. VPNs, Firewalls, Certificates and so on are notoriously difficult both to get right in the first place and to keep secure over time. And that's with professional help in enterprise settings. Even those of us in the know don't spend that much time on things in our home environments.
K.I.S.S. - once you've set up NGROK securely there are all sorts of ways you could trigger it temporarily with little effort, no firewall/router changes needed, no extra services to run on your server. Telegram is convenient for me because I already run several bots. For others, a different tool or even email would be better. If you have a VPN already set up and secure, by all means use that since any vulnerabilities are already there! Just be sure to take care of your remote devices - which is where I think I started with this conversation.
