Comment by philipwhiuk
3 days ago
> Only the first 5 characters of a SHA-1 hash go to HIBP
Some would consider the first five characters being sent over the internet to be 'your secret leaving your system'.
Some would consider phoning home to a remote server to be worrisome. It's home assistant not cloud assistant.
I would consider a single byte sent to any server without my explicit permission a breach of trust.
If I were setting up HA it is exactly because I don't want the shenanigans of Google Home and Alexa.
Seeing this, I don't think I'm going to touch it. Alexa might be more respectful of user data.
It is already enough to prove the existence of a password or that another password is not disclosed for example.