Comment by Arcuru

It's a SHA-1, per https://github.com/home-assistant/supervisor/blob/main/super....

Their docs link to this explanation, in which the link I give uses an example that appears to be identical to the HA implementation - https://blog.cloudflare.com/validating-leaked-passwords-with...

I might be misunderstanding, but if the first 5 digits is a unique hash in the HIBP database then an attacker can replay that request, then lookup the hash. But "When hashes are grouped together by a Hash Prefix of 5 characters, we find the median number of hashes associated with a Hash Prefix is 305." {ibid}.

If you've acquired leaked passwords as HIBP have, you then just make hash lookup tables, then you have 305 potential passwords to try, or try and whittle down. If the bucket of hashes has "hunter2" in it, for example, then that's perhaps a good one to try - https://blog.cloudflare.com/validating-leaked-passwords-with... is worth reading.

It's a "severe invasion of privacy" to send anything to the Internet without the user's permission, period. Privacy is about having control over what information you disclose, how much, and to whom. Developers shouldn't be allowed to make that decision on behalf of the users.

because why should my electric light scheduler be in the business of inspecting my passwords and furthermore involving third parties in inspecting my passwords?

If your password is normally protected by a KDF that is hard enough that 1x SHA-1 is negligible in comparison then someone attacking your securely hashed password gets at a million-fold speedup in their search from knowing 5 characters of its sha1. (I'm assuming '5 characters' is hex, if it's 5 bytes then the speedup is a trillion-fold).

Even if the SHA1 isn't totally negligible in cost, if they're attacking many users at once they can share the SHA1 work across all of them (as it's not salted) making it marginally negligible. So someone attacking a sha-1 salted password database with a million users where they have the 20 bit unsalted sha1's still gets a similar speedup, even though the 'hard' hash is just as fast as the easy one.

Security aside, -- if you use some old crap password on internet isolated IOT devices that HA can reach (as some people I know do)-- then the 5 characters is a one in a million identifier which probably uniquely identifies you. The database sees your IP address and so you've probably connected to identity (via old leaks) to your IP to them and anyone surveilling your traffic. You've also connected your old weak passwords to that IP, so someone that gets access to it would have a ready database of plaintext passwords to use to initialize a password search against any exposed endpoints.

Even just making the request at all exposes information about the software you're running, that there are devices at that IP (which otherwise might be inbound blocked), etc.

I think the privacy concern is much worse than the security one: For security you can change any exposed passwords, presuming they didn't get you hacked yet. The privacy loss is far more irreversible.

Many people use home assistant in order to avoid security and privacy violating cloud services, so this is a significant disappointment.

Because free (as in freedom) software should not betray the trust of its users by adding connected integrations that they haven't asked for or consented to. I expect software like HA to be fully offline.

I think the main issue is that you don't expect a service to send anything related to your data without letting you know. Even if it's a ping "alive" sent to a server they own.

Imagine if your smart toilet would just send a small anonymized message to a urine sampling analysis service so it can let you you know your cholesterol levels are a bit high, totally anonymous, totally for your benefit. Maybe it's a great feature, but would anyone expect this to happen without consent / opt in?

It's probably overzealous of HA to do this, but ultimately it isn't. The context missing from this HN thread so far is that the reporter, Viss, has been frankly not credible on security in general for a really long time, despite being a big name in the community on stuff like OSINT. A lot of people in the OSINT sphere basically believe any information being public at all is a security risk and prefer you to pay them exorbitant consulting fees to come up with numerous ways of rephrasing their circular reasoning about why.

[dead]