Comment by handoflixue
3 days ago
It's a password management system - it's not "gathering" passwords, it is being explicitly given passwords by the user. This is a very important difference! The entire point of the application is that you give it your passwords and it keeps them secure.
The designer felt that "secure" included "is this password already published, online, in a known database breach", which is not an unreasonable interpretation.
The documentation has been clarified. There was a a feature flag. Calling this malicious is just absurd flame-bait.
I understand you're OK with a password managing application making remote requests to a third party without your permission or consent. For me it's unacceptable and unforgivable. We have differing opinions.
My whole point is that this should be "differing opinions" and not "moral condemnation". It's not a mere "difference of opinion" if you consider something unacceptable and unforgivable, or act entitled towards the maintainers of a free, open-source program that doesn't conform to your "opinions."
Home assistant is not a password management system. It's a home automation system. The fact that they added password management features into it does not change what it is. Is your email client a password management system because you enter your password into it?
It wasn't malicious but it wasn't expected.