supervisor

There seems to be a pull request now to make this feature opt-in: https://github.com/home-assistant/supervisor/pull/7382 It'll be interesting to see whether that gets accepted or not.

It's a SHA-1, per https://github.com/home-assistant/supervisor/blob/main/super.... Their docs link to this explanation, in which the link I give uses an example that appears to be identical to the HA implementation - https://blog.cloudflare.com/validating-leaked-passwords-with... I might be misunderstanding, but if the first 5 digits is a unique hash in the HIBP database then an attacker can replay that request, then lookup the hash. But "When hashes are grouped together by a Hash Prefix of 5 characters, we find the median number of hashes associated with a Hash Prefix is 305." {ibid}. If you've acquired leaked passwords as HIBP have, you then just make hash lookup tables, then you have 305 potential passwords to try, or try and whittle down. If the bucket of hashes has "hunter2" in it, for example, then that's perhaps a good one to try -

Frenck here, I'm the one who replied on that issue. My replies there were more dismissive than they should have been. My apologies. I've posted a follow-up on the issue. As it turns out, the check can already be turned off after all: ha security options --pwned=false It has been part of the Supervisor for years and checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why people are noticing it now. Only the first 5 characters of a SHA-1 hash go to HIBP, and the matching happens locally: https://github.com/home-assistant/supervisor/blob/main/super... Our documentation should have explained all of this, including how to turn it off. We'll get that updated.

I recently discovered the home-assistant supervisor [1] repository. It's awesome to see such a well-designed, mature, and actively maintained open-source python application. I've found that there's no shortage of high quality python libraries and frameworks to learn from, but open-source applications aren't as common. I love coming across repos like this so I can study their design. [1] https://github.com/home-assistant/supervisor

https://github.com/home-assistant/supervisor/commit/3d74e07c... Oh dear. This is awful for the same reason that https://thedailywtf.com/articles/Injection_Rejection is.

I'm guessing these two commits (one or both) are related to the CVEs: - https://github.com/home-assistant/supervisor/commit/2ae2d0e1... ("Performance tweaks middleware" but doesn't seem to be about performance but about auth) - https://github.com/home-assistant/supervisor/commit/3d74e07c... ("Backport core api filter" but doing request filtering based on "potential harmful query string") No need to be secretive about it. Updates have been automatically pushed + if someone wanted to see how it was fixed in order to exploit it, they'll be able to browse through the commits just like I did, and probably find it even easier as I'm no pentester, just a casual programmer.

Nice to see HA getting some love on HN. A colleague recommended it to me about 3 years ago as an alternative to Domoticz. I've migrated back than and haven't looked back since. I consider myself a real Home Assistant enthousiast. I've contributed some small amounts to the project, created and maintain my own add-ons and love to share my configuration with others. Although most of the things currently just work, especially with the (migrated) UI integrations. Some things still feel very unfinished, like blueprints. Which was a terrific idea, but maintaining and keeping those up to date is an absolute nightmare and you will have to that yourself [1]. Same with battery powered devices. When they work, it's all great, but having to watch their battery level is just a hassle. You can create your own automation to do that for you, but it seems