Comment by infinite_spin
3 days ago
I do get the sense that you're not malicious, just that maybe you're not seeing this from the standpoint of someone that assigns a higher value to some elements of privacy. In this case, your user base expects a home automation system. They do not expect that system to scan their computer for passwords, regardless of how "safely" the home automation system were to behave.
You might have a heart of gold, and just be having an off day due to reasons, so I hope people cut you some slack, but if I were you I'd update this feature to be opt-in and conspicuous, immediately
I've not seen the claim that it is scanning their computer for passwords. My understanding is the ones it checks are those that are used in HA's config (I assume, for different devices it connects to in your home).
There are a lot of problems with poor security practices devices of this type. Maybe the feature is a bit too paternalistic but it is not malicious.
I still agree its not the right default but thats quite a lot less invasive than you are making it sound.
My concern is Supervisor runs the operating system for the computer Nabu Casa sold me to run HAOS.
In the off chance Supervisor inadvertently revealed the first 5-characters of my password hash to something else on or off my network over the years, I’m now going to spend a weekend reinstalling a fresh copy of HAOS, blocking it from Internet access until I can run the command to disable this, issuing new passwords and accounts to my household, and resetting the passwords for all my devices and integrations, then restoring all my automations.
Better documentation will definitely help restore confidence, but good practice for me to cycle all my passwords and tighten network policies anyways.
It's the first 5 chars of the SHA, nto first 5 chars of the PW - this is a common pattern and how all HIBP integrations work (including the ones built into all major password managers nowadays).
The first 5 characters of the SHA of the password, which is totally, vastly different than the first 5 of the password itself
That’s an overreaction.
1 reply →
Security issues rarely arise from explicitly malicious behavior. It's usually careless attitudes until the holes in the swiss cheese align
in defense of frenck, this is actually a very secure way to perform the task. swiss cheese alignment won't happen because of this
however
it's also a feature transmitting information in a product that bills itself as being offline. imo it's a (minor) privacy violation, not a security violation.
> swiss cheese alignment won't happen because of this
This is the problem. You do not know what you do not know. There have already been papers written about the problems with HIBP. You don't have to understand the threat model for it to exist.
It's a trust violation.
1 reply →
It's not just a home automation system though. People setup HA for a lot of reasons, but one of them is that they don't want other people/companies in control of what goes on in their home, spying on them, etc. The sort of people who go to the trouble to set up a server, deal with all of the integration issues, etc so that they can get something that they have control over of.
Anyhow that sort of person might not take kindly to having a hash of their password sent to some random web server without being asked first.
How is a provably anonymous operation a violation of privacy?
I value my privacy quite highly, but I don't mind harmless, anonymous use of my data
Even sending out a request to a third party server without any input by the user or good reason (which I wouldn’t count this as) should be counted as a privacy violation because HIBP can now infer that network is running HA.
Wait, how? It's not like it's the only app doing this, and I would assume it's not signing it's requests?
2 replies →
Depending on how it's batched, this tells HIBP (and any MITM -- even one that can only see ciphertext) roughly how many unique passwords you use. Knowing the 5-character hash prefix also cuts down brute force attacks by a factor of a million -- though in practice this is only a real issue if you use one of the compromised passwords (there's only a few hundred candidates per prefix), in which case you're kind of screwed already because they're probably in dictionaries anyway.
I don't think these are /critical/ issues and the latter is basically just an argument against the HIBP service, but the point is that a user should opt-in to sharing their data in cases like this so they have a chance to make an informed decision. The k-anonymity design of the HIBP service has a degree of anonymity, it's not "provably anonymous" like homomorphic encryption or similar schemes would be.
Does it actually batch them in an identifying way?
Is there any realistic value to knowing "how many unique passwords you use"? If you already have one of my passwords compromised, you'd presumably try it on the rest of my accounts regardless?
My browser fingerprint leaks, what, thousands of times more information than that - surely fixing applications like Chrome to have sensible privacy-preserving opt-in-only behavior is vastly more important than nagging some obscure open source software about an edge case that can barely be exploited?
3 replies →
The use isn't anonymous, it sends your IP address to a third party, a personally identifying piece of information.
This is fundamental feature of all traffic sent via IP unfortunately.
Okay, but (a) it's a well known, trusted service and (b) yeah, my browser does that every time I visit a site but no one seems to freak out about that. Like... an IP address by itself is useless, and it's being handed to a trusted party anyway...
2 replies →
That's not how privacy works. I don't care what you mind or consider harmless, no tool should be scanning the file system for anything without explicit consent and permission.
Making such a behavior opt-out is malicious, intentionally or not. --pwned=false? Give me a fucking break, so you're pwned by default then. Unbelievable what some developers think they can get away with.
Did it scan the file system? Or did users hand over the passwords as part of the application? Because everything else makes it sound like the latter.
The site is called "Have I Been Pwned", thus the cutesy name of the flag...
6 replies →