Comment by jeremyjh
3 days ago
I've not seen the claim that it is scanning their computer for passwords. My understanding is the ones it checks are those that are used in HA's config (I assume, for different devices it connects to in your home).
There are a lot of problems with poor security practices devices of this type. Maybe the feature is a bit too paternalistic but it is not malicious.
I still agree its not the right default but thats quite a lot less invasive than you are making it sound.
My concern is Supervisor runs the operating system for the computer Nabu Casa sold me to run HAOS.
In the off chance Supervisor inadvertently revealed the first 5-characters of my password hash to something else on or off my network over the years, I’m now going to spend a weekend reinstalling a fresh copy of HAOS, blocking it from Internet access until I can run the command to disable this, issuing new passwords and accounts to my household, and resetting the passwords for all my devices and integrations, then restoring all my automations.
Better documentation will definitely help restore confidence, but good practice for me to cycle all my passwords and tighten network policies anyways.
It's the first 5 chars of the SHA, nto first 5 chars of the PW - this is a common pattern and how all HIBP integrations work (including the ones built into all major password managers nowadays).
The first 5 characters of the SHA of the password, which is totally, vastly different than the first 5 of the password itself
That’s an overreaction.
I'm aware, but like I said, still good practice for me.
To me, everyone swearing off HA over this is overreacting.