As implemented it leaks information to HIBP. Whether or not that is a risk depends on your threat model. Leaking information about your local environment is a fact regardless of your threat model.
It should have remained a privacy matter, the security claims are just confusing .
As he said: "This mechanism could be abused by a malicious threat actor with access to the home assistant github repos in a variety of ways." -> If you get access to write to the Github repo, yes in fact you can for sure do much more damage without ever touching this feature.
Also "I can give you a list as long as my arm about how I could abuse this to loot credentials from every HA install on the planet." -> Waiting for it.
Viss is trying to claim there is a security risk here when there isn't one. It's totally fair game to mention that.
As implemented it leaks information to HIBP. Whether or not that is a risk depends on your threat model. Leaking information about your local environment is a fact regardless of your threat model.
It should have remained a privacy matter, the security claims are just confusing .
As he said: "This mechanism could be abused by a malicious threat actor with access to the home assistant github repos in a variety of ways." -> If you get access to write to the Github repo, yes in fact you can for sure do much more damage without ever touching this feature.
Also "I can give you a list as long as my arm about how I could abuse this to loot credentials from every HA install on the planet." -> Waiting for it.