Comment on PSA to Home Assistant users
frongt@lemmy.zip 11 hours ago
No, your credentials have not been “hoovered up”. A hash is not reversible, and a partial hash would match far too many potential passwords to be any more accurate than random guesses.
Still, uploading any data, especially identifying data, should absolutely not be enabled by default.
They have been hoovered up, by home assistant. I made no claim, nor did the source, that clear-text credentials were shipped anywhere.
This is meant to drive awareness on a transparency and dev issue, not an overt compromise. My language was maybe a bit too inflammatory though, I suppose.
any credentials in your config have been hoovered up
Anyone reading this would interpret it exactly as @frongt@lemmy.zip did. Its well passed “inflammatory” and hovering around “misinformation”.
So for as far as I understand it:
Yes, this is a big issue on the developers part as this should not have happened without consent.
No, this is not a direct security breach for every and all home assistant users. You do not need to immediately change all your passwords (due to it being partial hashes)
Did I understand correctly? I’m not that deep into how all this works as I am mostly a enthusiast user without a lot of computer science knowledge
No to both.
Its a long-standing and documented feature. Included in that documentation is how to turn it off, which was added a few years back iirc.
Its brought up every once in a while by people.who don’t understand cryptographic hashes or the hibp tools. Usually with a bunch of posts about how passwords are being leaked (they aren’t).
sk@utsukta.org 11 hours ago
KaninchenSpeed@lemmy.blahaj.zone 11 hours ago
it only send the first 5 characters of the sha1 hash, thats pretty much useless for finding the password
socphoenix@lemmy.world 11 hours ago
This is such a nothing burger, they’re using those first five to get partial matches then doing the actual checks locally on the hash…
Privacy was a design requirement for this feature from the start, which is why your secrets never leave your system. The Supervisor hashes them locally and sends only the first 5 characters of the SHA-1 hash to Have I Been Pwned. HIBP returns every hash starting with that prefix, and the matching happens on your own instance. You can see exactly what it does here: github.com/home-assistant/supervisor/…/pwned.py
You are right that our documentation should have explained this, including how to turn it off. We’ll get that page updated.
…/Frenck `