So, uh, @homeassistant@fosstodon.org has been sending partial hashes of any password it can find up to `Have I Been Pwned` for 5+ years. Only recently did they fix the display / warning to actually do something and alert on API hits.
This ""feature"" is on by default, and requires console/CLI commands to disable.
@homeassistant@fosstodon.org - Do better. This should be an integration like the default weather app. This should be entirely optional by users and not hidden away in the python sub-basements of the HA backrooms.
disable with `ha security options --pwned=false` in a console
https://github.com/home-assistant/home-assistant.io/issues/49314
Heads up, if you use home assistant, any credentials in your config have been hoovered up without your knowledge
This is such a nothing burger, they’re using those first five to get partial matches then doing the actual checks locally on the hash…
To be transparent: this check isn't new, it has been part of the Supervisor for years. It checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why you're seeing it now. Privacy was a design requirement for this feature from the start, which is why your secrets never leave your system. The Supervisor hashes them locally and sends only the first 5 characters of the SHA-1 hash to Have I Been Pwned. HIBP returns every hash starting with that prefix, and the matching happens on your own instance. You can see exactly what it does here: https://github.com/home-assistant/supervisor/blob/main/supervisor/utils/pwned.py. You are right that our documentation should have explained this, including how to turn it off. We'll get that page updated. ../Frenck
it only send the first 5 characters of the sha1 hash, thats pretty much useless for finding the password
This is such a nothing burger, they’re using those first five to get partial matches then doing the actual checks locally on the hash…