So, uh, @homeassistant@fosstodon.org has been sending partial hashes of any password it can find up to `Have I Been Pwned` for 5+ years. Only recently did they fix the display / warning to actually do something and alert on API hits.
This ""feature"" is on by default, and requires console/CLI commands to disable.
@homeassistant@fosstodon.org - Do better. This should be an integration like the default weather app. This should be entirely optional by users and not hidden away in the python sub-basements of the HA backrooms.
disable with `ha security options --pwned=false` in a console
https://github.com/home-assistant/home-assistant.io/issues/49314
Heads up, if you use home assistant, any credentials in your config have been hoovered up without your knowledge
Yes, this is a big issue on the developers part as this should not have happened without consent.
No, this is not a direct security breach for every and all home assistant users. You do not need to immediately change all your passwords (due to it being partial hashes)
Did I understand correctly? I’m not that deep into how all this works as I am mostly a enthusiast user without a lot of computer science knowledge
Its a long-standing and documented feature. Included in that documentation is how to turn it off, which was added a few years back iirc.
Its brought up every once in a while by people.who don’t understand cryptographic hashes or the hibp tools. Usually with a bunch of posts about how passwords are being leaked (they aren’t).
So for as far as I understand it:
Yes, this is a big issue on the developers part as this should not have happened without consent.
No, this is not a direct security breach for every and all home assistant users. You do not need to immediately change all your passwords (due to it being partial hashes)
Did I understand correctly? I’m not that deep into how all this works as I am mostly a enthusiast user without a lot of computer science knowledge
No to both.
Its a long-standing and documented feature. Included in that documentation is how to turn it off, which was added a few years back iirc.
Its brought up every once in a while by people.who don’t understand cryptographic hashes or the hibp tools. Usually with a bunch of posts about how passwords are being leaked (they aren’t).