I never authorized an integration that scans my secrets
Home Assistant's default password scanning, sending partial hashes to "Have I Been Pwned" without explicit opt-in, ignited a privacy firestorm. A developer's initial dismissive response escalated the conflict, prompting an apology and a broader debate on open-source project management, user trust, and the nuances of data privacy. This incident became a case study in how not to handle community feedback and the importance of transparent communication.
The Lowdown
Home Assistant, the popular open-source smart home platform, found itself in hot water after a user exposed a built-in feature that scans user-configured secrets against the "Have I Been Pwned" (HIBP) database without explicit user consent. This discovery sparked a heated GitHub issue, challenging the project's privacy-centric ethos and developer-community relations.
- The initial complaint, filed by a security professional, branded the default scanning as a "severe invasion of privacy," demanding an opt-in mechanism and raising concerns about potential abuse.
- A lead Home Assistant developer initially dismissed the concerns, comparing the feature to password managers and emphasizing the use of k-anonymity where only the first five characters of a SHA-1 hash are sent to HIBP.
- Despite further appeals and threats of uninstalling/forking from other users, the developer initially closed the issue as "won't fix," leading to accusations of a "toxic" and dismissive attitude.
- Following significant community backlash and the issue gaining traction, the developer issued an apology for his previous tone and clarified that the feature could be disabled via a CLI command (
ha security options --pwned=false). - It was revealed that the feature had been present for years but only became visible due to a recent warning fix, and the project committed to updating its documentation.
- The core controversy highlighted the tension between enhancing security proactively and respecting user autonomy through explicit consent, particularly in a privacy-focused open-source project.
Ultimately, this incident served as a stark reminder for open-source projects about the critical importance of transparent communication, clear documentation, and a responsive, empathetic approach to user feedback, especially when sensitive user data is involved.
The Gossip
Frenck's Faux Pas and Follow-up
The developer's initial dismissive, unapologetic tone on GitHub (`"This issue is closed as won't fix. Sorry."`) drew widespread condemnation from HN commenters, many labeling it as "toxic" or "petty." His subsequent apology, explaining the feature and the existence of a disable option, was met with mixed reactions; some appreciated the clarification and introspection, while others questioned its sincerity, implying it was a response to the "viral" nature of the issue on platforms like HN. This theme explored the difficult balance of developer temperament and community management in open-source.
Privacy Predicaments: Opt-in or Opt-out?
A core debate centered on whether Home Assistant's default, non-opt-in integration with "Have I Been Pwned" (even with k-anonymity hashing) constituted a privacy invasion. Many users argued for the "Principle of Least Astonishment," asserting that *any* communication of user data (even partial hashes) to a third party should require explicit consent, regardless of the perceived security benefits or technical safeguards. This stance emphasizes user control over data flow, contrasting with arguments that the feature, designed for security and privacy (localside matching), was benign.
The Forking Fallout and Loyalty Lines
The original poster's and other users' statements about "uninstalling and forking" the project sparked a discussion on the legitimacy of such declarations. Some argued it's a valid and powerful form of feedback in the open-source world, representing a user's ultimate freedom and a market signal. Others, including the developer, viewed it as an unproductive "threat" or an attempt at intimidation, hindering constructive dialogue. This theme delved into the dynamics of power, expectation, and commitment between open-source projects and their users.
Hashing Hype and Hardened HIBP
While the ethics of consent were paramount, a subset of the discussion engaged with the technical specifics of the HIBP integration. Commenters examined the implications of sending only the first five characters of a SHA-1 hash. Concerns were raised about potential (albeit theoretical) risks, such as the possibility of partial hashes appearing in logs or being used to narrow down brute-force attacks on common passwords, despite HIBP's design to mitigate these issues through local matching against returned lists. The discussion also touched on the difference between SHA-1 and SHA-256 for this purpose.