Comment by ahofmann
3 days ago
Also frenck explained how the feature works and why this is save.
On the other side Viss basically just said "trust me bro, it is not save and by the way, I'm THE expert and I'm so very smart, that I don't even need to list some facts why this could be unsafe, just fix it NOW", which I find exhausting, unhelpful and boring.
Thats the thing though, it's not safe [1] and puts trust in a third party - HIBP.
To do that automatically without any notice to the user breaks the fundamental value proposition of a local home assistant which over and over again preaches keeping things local and private.
As someone who relies on home assistant every day, I'm quite disappointed to hear Frenck's response to this.
[1] http://cablej.io/blog/k-anonymity/
From the issue author: "I can give you a list as long as my arm about how I could abuse this to loot credentials from every HA install on the planet.".
From the linked article I can count 2 with following conditions:
1. relies on a malicious or compromised lookup server, linking lookups to the same user, the user checking two predictably similar passwords, both passwords being breached, the attacker having their plaintext candidates, and knowing the account identifier for account takeover
2. relies on a malicious or compromised lookup server, linking lookups to the same user, the user checking multiple predictably related passwords, sufficient computing resources to search the original password space, and knowing the account identifier for account takeover, the attack demoed seems to work if you have a weak password to starts with (10 chars alphanum).
Yeah, I think the situation is that if your password is already weak/known to a level that it should already be considered compromised, a malicious HIPB could surface that compromise a lot more reliably/quickly.
Sending out even a ping without explicit user consent makes it unsafe.
How? What is you definition of unsafe?
Because it is happening without user's consent. Imagine you invite me for a drink in your home, and while you're not looking I go and open the front door, for whichever reason. How would that make you feel?
1 reply →
They have always been like that