So, uh, @homeassistant@fosstodon.org has been sending partial hashes of any password it can find up to `Have I Been Pwned` for 5+ years. Only recently did they fix the display / warning to actually do something and alert on API hits.
This ""feature"" is on by default, and requires console/CLI commands to disable.
@homeassistant@fosstodon.org - Do better. This should be an integration like the default weather app. This should be entirely optional by users and not hidden away in the python sub-basements of the HA backrooms.
disable with `ha security options --pwned=false` in a console
https://github.com/home-assistant/home-assistant.io/issues/49314
Heads up, if you use home assistant, any credentials in your config have been hoovered up without your knowledge
Not really, they are testing your passwords against have I been pawnd. I agree that transparency should apply here, and also an upfront question to skip.
But it’s not “unsafe” or a privacy breach per se. No password has actually been “sent” anywhere only a partial hash that is useless for accessing your home assistant.
Not really, they are testing your passwords against have I been pawnd. I agree that transparency should apply here, and also an upfront question to skip.
But it’s not “unsafe” or a privacy breach per se. No password has actually been “sent” anywhere only a partial hash that is useless for accessing your home assistant.