supervisor

There seems to be a pull request now to make this feature opt-in: https://github.com/home-assistant/supervisor/pull/7382 It'll be interesting to see whether that gets accepted or not.

It's a SHA-1, per https://github.com/home-assistant/supervisor/blob/main/super.... Their docs link to this explanation, in which the link I give uses an example that appears to be identical to the HA implementation - https://blog.cloudflare.com/validating-leaked-passwords-with... I might be misunderstanding, but if the first 5 digits is a unique hash in the HIBP database then an attacker can replay that request, then lookup the hash. But "When hashes are grouped together by a Hash Prefix of 5 characters, we find the median number of hashes associated with a Hash Prefix is 305." {ibid}. If you've acquired leaked passwords as HIBP have, you then just make hash lookup tables, then you have 305 potential passwords to try, or try and whittle down. If the bucket of hashes has "hunter2" in it, for example, then that's perhaps a good one to try -

Frenck here, I'm the one who replied on that issue. My replies there were more dismissive than they should have been. My apologies. I've posted a follow-up on the issue. As it turns out, the check can already be turned off after all: ha security options --pwned=false It has been part of the Supervisor for years and checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why people are noticing it now. Only the first 5 characters of a SHA-1 hash go to HIBP, and the matching happens locally: https://github.com/home-assistant/supervisor/blob/main/super... Our documentation should have explained all of this, including how to turn it off. We'll get that updated.