Insecure secrets in core_samba

Configuration
1

Hi all
today I got the 2 following messages in notifications.
What they actually mean and how can I fix them?

Insecure secrets in core_samba
The add-on core_samba uses secrets which are detected as not secure, see https://www.home-assistant.io/more-info/pwned-passwords for more information.

7 minutes ago
Insecure secrets in core_ssh
The add-on core_ssh uses secrets which are detected as not secure, see https://www.home-assistant.io/more-info/pwned-passwords for more information.

7 minutes ago
2

This means that the passwords you use for the Samba add-on is weak and on the pwned list.

2 Likes
3

Sure , but if your SMB ports are closed on your firewall , why is that important ?

1 Like
4

There’s a heated debate about this issue over on this thread.

5

How do we turn these notifications off?

1 Like
6

I would also really like to disable them!

1 Like
7

By fixing your passwords.

I doubt that is going to happen but you never know.

9

I am getting this error in NodeRed, and there are no passwords in NodeRed as far as I know.

Insecure secrets in a0d7b954_nodered
The add-on a0d7b954_nodered uses secrets which are detected as not secure

I would also like to disable this notification, or at least have it tell me where to find my password that it hates.

10

Ok, i tried changing my Samba passwords twice to 15 digit ones using random words and special characters and yet still get the insecure secrets warnings.
What am I doing wrong?

11

Vote for it to be an optional
Hope for enough votes
Hope devs listen to the community

Here’s the link: Opt~out/in Password check to third party

Meanwhile you can block the api call if you don’t want the notifications. (This also includes no check, if you can live with that). This can be done in a few ways, but a simple one is to have api.pwnedpasswords.com either blocked or resolved locally to 127.0.0.1.

12

Has there been an official response to the growing number of people who do not like/want/concerned about this issue?

13

Not what I know of. Discord and GitHub seems silent also.

14

Anyone figure this out? I’m still getting the notification.

15

FIX THE PASSWORD… that is the solution!

2 Likes