They have been hoovered up, by home assistant. I made no claim, nor did the source, that clear-text credentials were shipped anywhere.
This is meant to drive awareness on a transparency and dev issue, not an overt compromise. My language was maybe a bit too inflammatory though, I suppose.
Yes, this is a big issue on the developers part as this should not have happened without consent.
No, this is not a direct security breach for every and all home assistant users. You do not need to immediately change all your passwords (due to it being partial hashes)
Did I understand correctly? I’m not that deep into how all this works as I am mostly a enthusiast user without a lot of computer science knowledge
Its a long-standing and documented feature. Included in that documentation is how to turn it off, which was added a few years back iirc.
Its brought up every once in a while by people.who don’t understand cryptographic hashes or the hibp tools. Usually with a bunch of posts about how passwords are being leaked (they aren’t).
They have been hoovered up, by home assistant. I made no claim, nor did the source, that clear-text credentials were shipped anywhere.
This is meant to drive awareness on a transparency and dev issue, not an overt compromise. My language was maybe a bit too inflammatory though, I suppose.
Anyone reading this would interpret it exactly as @frongt@lemmy.zip did. Its well past “inflammatory” and hovering around “misinformation”.
Its also documented:
https://www.home-assistant.io/more-info/pwned-passwords/
So for as far as I understand it:
Yes, this is a big issue on the developers part as this should not have happened without consent.
No, this is not a direct security breach for every and all home assistant users. You do not need to immediately change all your passwords (due to it being partial hashes)
Did I understand correctly? I’m not that deep into how all this works as I am mostly a enthusiast user without a lot of computer science knowledge
No to both.
Its a long-standing and documented feature. Included in that documentation is how to turn it off, which was added a few years back iirc.
Its brought up every once in a while by people.who don’t understand cryptographic hashes or the hibp tools. Usually with a bunch of posts about how passwords are being leaked (they aren’t).
yes, the phrasing makes it sound like a major security breach. not your fault though, we’ve been conditioned to click bait for years now.