Comment by handoflixue
2 days ago
Did it scan the file system? Or did users hand over the passwords as part of the application? Because everything else makes it sound like the latter.
The site is called "Have I Been Pwned", thus the cutesy name of the flag...
Perhaps it scans a database and not the file system, but either way, if I see an application gathering passwords and sending remote requests to an unauthorized third party "pwnedpasswords.com" (literally) without my explicit command to do so, then it is acting maliciously by design.
It's a password management system - it's not "gathering" passwords, it is being explicitly given passwords by the user. This is a very important difference! The entire point of the application is that you give it your passwords and it keeps them secure.
The designer felt that "secure" included "is this password already published, online, in a known database breach", which is not an unreasonable interpretation.
The documentation has been clarified. There was a a feature flag. Calling this malicious is just absurd flame-bait.
I understand you're OK with a password managing application making remote requests to a third party without your permission or consent. For me it's unacceptable and unforgivable. We have differing opinions.
2 replies →
Home assistant is not a password management system. It's a home automation system. The fact that they added password management features into it does not change what it is. Is your email client a password management system because you enter your password into it?
It wasn't malicious but it wasn't expected.