-75
PSA to Home Assistant users (infosec.exchange)
submitted 3 weeks ago by to c/selfhosted@lemmy.world
12 comments fedilink hide all child comments
 

Heads up, if you use home assistant, any credentials in your config have been hoovered up without your knowledge

you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 3 weeks ago (1 child)

So for as far as I understand it:

Yes, this is a big issue on the developers part as this should not have happened without consent.

No, this is not a direct security breach for every and all home assistant users. You do not need to immediately change all your passwords (due to it being partial hashes)

Did I understand correctly? I'm not that deep into how all this works as I am mostly a enthusiast user without a lot of computer science knowledge

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 11 points 3 weeks ago

    No to both.

    Its a long-standing and documented feature. Included in that documentation is how to turn it off, which was added a few years back iirc.

    Its brought up every once in a while by people.who don't understand cryptographic hashes or the hibp tools. Usually with a bunch of posts about how passwords are being leaked (they aren't).

  • permalink
  • fedilink
  • source
  • parent