TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A Home Assistant user objected that the software checked password-marked app settings against Have I Been Pwned without an opt-in. A project maintainer said the feature has existed for years, hashes values locally and sends only the first five characters of each SHA-1 hash; the maintainer also shared a command to disable it and apologized for earlier replies.
A Home Assistant user challenged an existing password check after a recent release made its warning visible, saying they had not agreed to have password-marked settings checked against a third-party service. A project maintainer said the feature hashes values locally and sends Have I Been Pwned only a five-character SHA-1 hash prefix, then provided a command to disable the check and apologized for earlier dismissive responses.
The complaint was posted in a GitHub issue on the Home Assistant website documentation repository. The author described the check as an unapproved scan of secrets and asked for it to be opt-in, raising the possibility that someone with access to Home Assistant’s GitHub repositories could abuse the mechanism. That scenario was the user’s concern, not a confirmed security incident.
In a follow-up on October 16, maintainer Frenck said the check applies to app options marked as passwords and has been part of the Supervisor for years. According to the maintainer, a recent release fixed the warning that surfaces the check, which explains why users might only have noticed it recently. The comment did not identify the release date or specify how many installations were affected.
The maintainer said the Supervisor computes hashes on the user’s system and sends Have I Been Pwned (HIBP) only the first five characters of a SHA-1 hash. HIBP returns hashes sharing that prefix, and the Home Assistant installation checks locally for a match. The maintainer linked to the Supervisor code and said the documentation should explain both the check and how to disable it. The command given was ha security options --pwned=false.
Control Over Home Assistant Checks
The dispute concerns more than whether a password value is transmitted in full. It also concerns consent, disclosure and control: users may object to a local system contacting an outside service about password-related data even when the value itself stays on their device. Clear notice and a straightforward opt-out can matter to people who manage sensitive home networks or have strict policies about outbound requests.
The maintainer’s explanation describes a privacy-preserving design: the full password is not sent to HIBP, and matching happens locally. But the user argued that the check should not run without explicit permission and said they were concerned about possible abuse. The supplied discussion does not establish that credentials were exposed, that the mechanism was exploited, or that HIBP received complete passwords. Those distinctions matter: the reported issue is a disagreement about an existing feature and its disclosure, not evidence of a breach.
Providing a disable command gives users a way to stop the check, but does not settle the broader question of whether it should be enabled by default. The project’s promised documentation update could help users understand the behavior before encountering its warning.
As an affiliate, we earn on qualifying purchases.
Why the Warning Appeared Now
The report was filed in a repository for Home Assistant’s documentation, and the issue form classified it as a problem with content or a site feature. In an earlier response, a maintainer said the report would remain closed because that repository was not the place to change Supervisor behavior. The exchange grew tense, with the user insisting the matter was unresolved and other commenters asking for a disable option.
The later comment acknowledged that the earlier replies had been more dismissive than warranted. It clarified that the check was not newly introduced: according to the maintainer, a recent fix to the warning made the existing behavior more visible. The maintainer also said the documentation had not adequately explained the feature or the way to turn it off.
HIBP checks can use a k-anonymity approach, in which a service receives a partial hash rather than the full value and returns possible matches for local comparison. In this case, the specifics come from the Home Assistant maintainer’s account and the linked Supervisor code; the GitHub discussion does not include an independent technical review of the implementation.
“Your secrets never leave your system.”
— Frenck, Home Assistant maintainer
As an affiliate, we earn on qualifying purchases.
Open Questions on Consent and Scope
The discussion does not say whether the disable command applies across every Home Assistant installation or Supervisor version, or whether disabling the check persists through updates. It also does not detail precisely which app options qualify as password fields, how often checks run, or what network and logging information accompanies the hash prefix.
The maintainer said the documentation would be updated, but the supplied thread does not confirm that the changes have been published. Nor does it record an independent security assessment of the implementation or a response addressing the user’s proposed abuse scenarios. The user disputed the maintainer’s reassurance and said the issue was not resolved to their satisfaction; the maintainer kept it closed as a documentation issue and said the repository was not the place to make a feature change.
As an affiliate, we earn on qualifying purchases.
Documentation and User Opt-Out
The next stated step is for Home Assistant to update its documentation with an explanation of the check and instructions for turning it off. Users seeking to disable it can refer to the command shared by the maintainer, while checking that it is applicable to their installation.
The GitHub discussion does not announce a change to the default setting or a commitment to make the feature opt-in. Whether the project will revisit that policy, clarify the check’s scope, or publish further technical detail remains open. The thread was locked after the exchange became heated, limiting further discussion in that issue.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does the Home Assistant check do?
According to maintainer Frenck, Supervisor checks app options marked as passwords against Have I Been Pwned. The maintainer said it hashes values locally and compares possible matches on the user’s installation.
Does Home Assistant send passwords to Have I Been Pwned?
The maintainer said full secrets are not sent. The explanation says the Supervisor sends the first five characters of a locally generated SHA-1 hash, and HIBP returns hashes with that prefix for local matching. The supplied discussion does not include an independent audit.
How can the check be disabled?
The maintainer provided this command: ha security options --pwned=false. The discussion does not specify whether it works on every version or whether the setting persists through updates.
Why did users notice the check recently?
The maintainer said the check had been part of Supervisor for years, and that a recent release fixed the warning that surfaces it. The thread does not provide the release date or say how many users saw the warning.
Has Home Assistant confirmed a security breach?
No breach is described in the supplied discussion. The issue author raised concerns about potential abuse, but the thread provides no evidence that the mechanism was exploited or that full passwords were exposed.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
