Comment by thunderfork
3 days ago
So, wait, these are secrets that are already given to h-a, hashed, and just the first five characters of the hash sent up..?
Yeah, I agree with the maintainer, this strikes me as outrage theater over any actual problem, no?
If you tell me a piece of software that is not a password manager wants to send the first five characters of the hashes of my password to a third-party, without my explicit opt-in, I will say no without hesitation and without the need to hear more details. Not even if it's a random bit in the hash.
Most of people here probably would say the same.
So it should be clear if you look back at this.
It's fascinating that you feel that way, but "I feel this is a threat" isn't really explaining why you feel it's a threat, especially when the purpose is to identify passwords whose full cleartext is exposed, which I'd rate as a far more substantial concern
People here act like HA includes a script that collects every password on your computer and sends them all over plaintext HTTP. I'm disappointed to be honest.
I would like to see the write-up from the red teamer and white hat hacker that claim they could break into thousands of systems with five characters of a SHA hash of a password. Should be a fun read.
Yeah. The use of the word "scan" in the original article and the title is misleading. It doesn't scan your system looking for passwords and testing them. It appears to take the password you give to HA (either as your HA Password to login to HA, or for an integration) and check those. That is a much smaller impact than is being assumed by many here.