Comment on PSA to Home Assistant users
starkzarn@infosec.pub 9 hours agoThey have been hoovered up, by home assistant. I made no claim, nor did the source, that clear-text credentials were shipped anywhere.
This is meant to drive awareness on a transparency and dev issue, not an overt compromise. My language was maybe a bit too inflammatory though, I suppose.
So for as far as I understand it:
Yes, this is a big issue on the developers part as this should not have happened without consent.
No, this is not a direct security breach for every and all home assistant users. You do not need to immediately change all your passwords (due to it being partial hashes)
Did I understand correctly? I’m not that deep into how all this works as I am mostly a enthusiast user without a lot of computer science knowledge
No to both.
Its a long-standing and documented feature. Included in that documentation is how to turn it off, which was added a few years back iirc.
Its brought up every once in a while by people.who don’t understand cryptographic hashes or the hibp tools. Usually with a bunch of posts about how passwords are being leaked (they aren’t).
curbstickle@anarchist.nexus 9 hours ago
Anyone reading this would interpret it exactly as @frongt@lemmy.zip did. Its well passed “inflammatory” and hovering around “misinformation”.