Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- This feature should be opt-in, but can someone explain how this is a security concern? I don't understand how it would be an actual security risk to share the first 5 digits of the sha256 of my passwords.by Arcuru
- This is not an issue if you are running Home Assistant Core in a self hosted container; the relevant "supervisor" service that does the scanning is only part of "HA OS" and "HA Supervised."by gcommer
- Giving the home assistant core developers the benefit of the doubt, I am sure there are good intentions here. But if they are interested in adding new security features, adding support for phishing-resistant multi factor authentication (passkeys) would be much more valuable. Users have been asking for it for some time, and even submitted patches, which were rejected.by csoghoian
- You may find this unasked for scan humiliating, but we can mathematically prove we're not humiliating you. Any feelings of discomfort or humiliation are therefore invalid and should be set aside.
Edit: I'm sure a greater good argument can be made. I just don't think they are making it in a way that justifies the invasiveness.
by jackpepsi - As I understand it. There is research published which suggests HIBP type password checking schemes DO give meaningful signal to potential attackers. EG https://d0nut.medium.com/attacks-on-applications-of-k-anonym... and http://cablej.io/blog/k-anonymity/
It is absolutely not OK to participate in this scheme on a users behalf without their affirmative consent. You simply cant know the context of people's situations.
Even the information that there likely ARE some hits from my IP is a huge signal leak, to me.
Iv been using HA for a very long time and it feels like a betrayal of trust to me.
by rubinlinux - Toxic developers turned me off Home Assistant. The same developer is the star of this issue: https://github.com/NixOS/nixpkgs/pull/126326
Related discussion: https://news.ycombinator.com/item?id=27505277
by janice1999 - Frenck here, I'm the one who replied on that issue.
My replies there were more dismissive than they should have been. My apologies. I've posted a follow-up on the issue.
As it turns out, the check can already be turned off after all:
It has been part of the Supervisor for years and checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why people are noticing it now.ha security options --pwned=falseOnly the first 5 characters of a SHA-1 hash go to HIBP, and the matching happens locally: https://github.com/home-assistant/supervisor/blob/main/super...
Our documentation should have explained all of this, including how to turn it off. We'll get that updated.
by frenck - - Should a password manager warn me about reused passwords without sending things out without opt in? yes
- Should a password manager send even one byte of my data to any service, regardless of whether it is for a good intention and mathematically proven to be "safe" without opt in? I'd say no.
- So would any other product out there, be it a smart home manager or a toaster, send any of of my data, hashed or not to any 3rd party without opt in? even if it's just the byte "1" to a page called "donothing.com"? I say hell no.
- Should open source developers who are not Linus Torvalds be a bit nicer on a public issue?
- And should open source users should be less heated because "let us know if you plan to fix this or we will uninstall and fork it" deserves the "go ahead, this is open source, threats don't really help here"
We all can sometimes write a reply at the heat of the moment that we later regret. Frenk definitely realized it after the fact and I respect him owning it, apologizing, and keeping the old messages. He is right it's open source, and he doesn't owe anyone anything, but still, I believe a phoning home of any kind is violating The Principle of Least Astonishment.
by eranation