Home Assistant's maintainer called a password scan 'won't fix', then apologized on Hacker News
A user found that Home Assistant had been checking their password-marked settings against Have I Been Pwned. The first reply closed the issue as won't fix. Within hours the maintainer was back with an apology and an off switch.
The check lives in the Supervisor, hashes values locally and sends only a 5-character SHA-1 prefix to HIBP. It has existed for years; a recent release merely made its warning visible, which is how a user noticed it.
The maintainer's apology didn't end the argument. Readers objected to the premise: a home automation hub that phones out, even with a prefix, is not what they installed it for.
An issue closed in minutes, and the tool nobody knew about
The issue, titled "i never authorized an integration that scans my secrets," was opened by a user named Viss on October 16. It turned out not to be an integration at all. It is a Supervisor feature that scans app options marked as passwords against the Have I Been Pwned (HIBP) database. The reporter had never heard of it, called it a privacy violation, and asked for an off switch and an opt-in default.
Maintainer frenck first disagreed that this was a privacy issue, compared it to 1Password's approach and closed it as won't fix. Replies got more heated and the thread was locked. Then he posted a follow-up: the check can be disabled with ha security options --pwned=false; it has been in the Supervisor for years; a recent release fixed the warning that surfaces it. The Supervisor hashes values locally and sends only the first five characters of a SHA-1 hash to HIBP, with matching done on the user's own instance. He said the documentation should have covered this and would be updated. A duplicate (#49318) was merged into the original.
The maintainer shows up in the HN thread
"My replies there were more dismissive than they should have been. My apologies." — Frenck, the Home Assistant maintainer who closed the issue
Accepting the apology and the fix did not settle it. A reader who caught the 1Password comparison went after it:
"you mentioned 1Password did the same… but you failed to realize 1Password doesn't enable that option automatically without consent" — a commenter who read the first reply closely
Others attacked the technical defense. Five characters leaving the machine is still a transmission:
"Some would consider the first five characters being sent over the internet to be 'your secret leaving your system'." — a commenter who read the hash-prefix defense skeptically
A PLC and SCADA engineer made the sharpest process point, quoting the maintainer's own words back to him: problem solved, but "what about" the dismissive reply? And one long-time user explained why the cost is trust, not bandwidth:
"The entire reason I use Home Assistant is because I trust it to be the local, privacy focused home automation system." — a commenter who runs it for exactly that reason
Not everyone was hostile. A Rust developer with no stake in the project said the first reply looked like good faith even if it was unsatisfying, and asked what had led to it.
The lesson is about defaults, not hashes
The technical design is defensible: a k-anonymity prefix check is the standard way to query HIBP. What failed was disclosure. For a product whose entire pitch is staying local, any outbound call a user did not know about needs to be documented, visible, and either opt-in or loudly announced. Anyone running Home Assistant who wants zero outbound checks now has the command.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
90% of US working hours fall outside what AI benchmarks measure, Mercor finds
Mapping 29 agentic benchmarks onto the Labor Department's task database, Mercor found that the work AI is tested on is the work that already pays well.