Comment by joejoejoe2

From the issue author: "I can give you a list as long as my arm about how I could abuse this to loot credentials from every HA install on the planet.".

From the linked article I can count 2 with following conditions:

1. relies on a malicious or compromised lookup server, linking lookups to the same user, the user checking two predictably similar passwords, both passwords being breached, the attacker having their plaintext candidates, and knowing the account identifier for account takeover

2. relies on a malicious or compromised lookup server, linking lookups to the same user, the user checking multiple predictably related passwords, sufficient computing resources to search the original password space, and knowing the account identifier for account takeover, the attack demoed seems to work if you have a weak password to starts with (10 chars alphanum).