So, uh, @homeassistant@fosstodon.org has been sending partial hashes of any password it can find up to `Have I Been Pwned` for 5+ years. Only recently did they fix the display / warning to actually do something and alert on API hits.
This ""feature"" is on by default, and requires console/CLI commands to disable.
@homeassistant@fosstodon.org - Do better. This should be an integration like the default weather app. This should be entirely optional by users and not hidden away in the python sub-basements of the HA backrooms.
disable with `ha security options --pwned=false` in a console
https://github.com/home-assistant/home-assistant.io/issues/49314
Heads up, if you use home assistant, any credentials in your config have been hoovered up without your knowledge
A couple of clarifications, since this thread is getting heated: Home Assistant’s HIBP check uses k-anonymity — it sends only the first 5 characters of the SHA-1 prefix to the range API and matches the rest locally. Your actual password (and the full hash) never leaves the machine, so there’s no credential leak in any meaningful sense.
If you still want zero outbound traffic, the check is config-visible and you can point it at a local copy of the HIBP dump or disable it. The real takeaway: secrets in plain-text YAML are far more exposed to local risks — backups, shared configs, accidental git pushes — than to this feature. Use !secret entries and keep the secrets file out of anything you sync or commit.
A couple of clarifications, since this thread is getting heated: Home Assistant’s HIBP check uses k-anonymity — it sends only the first 5 characters of the SHA-1 prefix to the range API and matches the rest locally. Your actual password (and the full hash) never leaves the machine, so there’s no credential leak in any meaningful sense.
If you still want zero outbound traffic, the check is config-visible and you can point it at a local copy of the HIBP dump or disable it. The real takeaway: secrets in plain-text YAML are far more exposed to local risks — backups, shared configs, accidental git pushes — than to this feature. Use
!secretentries and keep the secrets file out of anything you sync or commit.