Home Assistant users object to password check; developers say it can be disabled

A user of the open-source home automation platform Home Assistant filed a complaint on GitHub on 16 October about an automatic password check that runs without the user's consent. The discussion took place in the project's documentation repository and involved maintainer Frenck. He eventually acknowledged that his earlier replies had been too dismissive and said the check can be switched off.

The user's objections

The author of the complaint argues that the system scans secrets without permission and sends data onward, even if it is hashed. In his view, the mechanism could be abused by a malicious actor with access to Home Assistant's GitHub repositories. He demanded that the feature be opt-in and asked how to disable it. He described himself as a security professional who gives presentations on security around the world.

The developers' replies

Frenck first closed the issue as won't fix, because the repository is meant for documentation. He said passwords are never sent out and that other tools, such as the 1Password password manager, use a similar approach. Several users called this response dismissive, and the thread was locked so that only collaborators could comment.

Frenck later apologized and explained that the check has been part of the Supervisor component for years and covers app options marked as passwords. A recent release fixed the warning that reports the check, which is why it has only now become noticeable.

How the check works

According to Frenck, the Supervisor hashes the password locally with SHA-1 and sends only the first five characters of the hash to Have I Been Pwned, a service that collects passwords exposed in data breaches. The service returns all hashes with that prefix, and the comparison happens on the user's own device. The check can be disabled with the command ha security options --pwned=false. The project has promised to update its documentation to explain this.