Home Assistant checks your passwords against HIBP — and not everyone was pleased

A user going by Viss — by his own account the head of Phobos Group and an offensive-security specialist — opened an issue in the Home Assistant documentation repository on October 16. His complaint was blunt: the system was scanning the "secrets" on his installation and sending them "up the line," and he had never agreed to any of it. He demanded the feature be made explicitly opt-in and asked how to turn it off at all.

The first response

Project developer frenck replied along the lines of "this is not an invasion of privacy" and closed the ticket. He pointed out that no passwords are actually transmitted and that the mechanism rests on the same k-anonymity principles as the similar check in the 1Password manager. That did not convince the author, who noted he was well acquainted with both Have I Been Pwned and its creator, and had himself deployed 1Password at Twitter back in 2011. His objection stayed the same: the point isn't whether the check is safe, but that it runs by default, without the owner's consent.

Others joined in. One asked for the issue to be reopened and for an opt-out to be implemented, threatening otherwise to fork the project; frenck declined to negotiate under ultimatums. The thread heated up quickly, and the conversation was locked to collaborators.

Apology and explanation

Later the tone shifted. frenck admitted his first replies had been more dismissive than the matter deserved, and apologized. As it turned out, the check can in fact be disabled with the command ha security options --pwned=false.

He also explained how the mechanism works. The feature isn't new — it has been part of the Supervisor for years and checks the settings fields marked as passwords. A recent release merely fixed the warning that exposed it, which is why users suddenly noticed it. Privacy was a design requirement from the start: the Supervisor hashes the password locally and sends only the first five characters of its SHA-1 hash to Have I Been Pwned. The service returns every hash with that prefix, and the matching happens on the user's own instance. The password itself never leaves the system.

frenck agreed the documentation should have explained all of this, including how to turn it off, and promised to update the relevant page. A separate ticket asking for guidance on consciously enabling the feature was marked as a duplicate.

The episode is instructive on both counts: how even a technically sound check breeds resentment when it runs quietly, and how a maintainer's defensive reflex can turn a reasonable question into a scandal faster than any actual vulnerability.

Source: Hacker News