Opt~out/in Password check to third party

[Dixey]

All this password security discussion has convinced me to change all my passwords from 12345 to 54321

[stephack]

Thanks for creating this feature request @MDSDM.
I’ve already discussed my disappointment with this decision here:

2021.3: My Oh My

I will also chime in that I am not a fan of anyone dictating what I do on my personal LAN. I completely understand the intent here but, as has often been the case, decisions are made that obviously haven’t been completely thought out. We wonder why many see the HA community as snobby and aloof, and I will continue to defend the super talented and super helpful devs here…but it has always been these types of decisions that poke holes in my defense. These types of nagging measures should ALWAYS ha…

[MDSDM]

@ur7x

About 5 years ago Microsoft’s Head Office did a corporate audit of their employees passwords… Over half were “Seahawks##” where the ## was the number of the month. 01-12… (those are all Pwnd too most with low double digits). They forced a special Charter, did another audit and Most of the passwords were “Seahawks##!” .

I guess it is better than nothing, but only slightly.

Amazing. Everyone knows it should be Steelers##!

[MDSDM]

@HeyImAlex

@MDSDM

Looking through the logs of HIBP, a returning pattern of requests from the same IP would indicate that this is a service that runs and not a user application. So with a pattern recognition, you can start single out what services are requesting what.

It’s worse than that. They’re sending the partial hash for all your secrets, in the same order every time. No randomization, no salting of the list. This is a textbook example for fingerprinting the calling device. And the third party could then start tracking when and how you change your passwords, if you change it into vulnerable ones, track your IPs using the fingerprint (are you using VPNs from time to time, are you changing your ISP, etc).

So I noticed. I get a slight headache from this… but I’m hoping for at least some dev to chip in here. But not holding my breath.

[banditdk]

This have to be a user option to be able to disable this password check. For me this is a annoying Bug more than a feature.
My local network, my choice of passwords.

[MDSDM]

Seems there are more and more solutions coming up to circumvent this from happening. Thank you very much for a great community. Please apply any solution at your own risk. Hopefully, this feature in the future will be optional.

Here are som mentioned:

@123 edited the code according:

Block HA from sending out passwords to third party

FYI Earlier I mentioned blocking api.pwnedpasswords.com but I’ve now switched to another method. Instead of blocking access I modified the code so it suppresses the request to api.pwnedpasswords.com. I changed the line to: _API_CALL = "https://127.0.0.1/range/{hash}" Restart Supervisor and it no longer makes the request to the external URL. This method provides the following benefits: No log message in PiHole indicating the request was blocked. No log message in Supervisor indicating it…

@code-in-progress just blocked api.pwnedpasswords.com in his firewall. Simple and effective.

@Freman Wrote an add-on:

GitHub - freman/hass-nopwned: A dirty little addon to patch haveibeenpwned...

[ur7x]

@MDSDM

@code-in-progress just blocked api.pwnedpasswords.com in his firewall. Simple and effective.

I just did this until the developers offer an official patch. My first black listed URL, HASS is always teaching me something new!

[sender]

Have tried to put it in adguard addon custom filtering rule… but I doubt it will work… thought homeassistant bypasses the dns. If this doesn’t work I will block via my firewall.

[Freman (Shannon)]

@MDSDM

Amazing. Everyone knows it should be Steelers##!

My favourite is sending websites videos of this

• Your password must be 8 characters long
• Your password must contain a lower case letter
• Your password must contain an uppercase letter
• Your password must contain a symbol
• Your password must contain a number

Passw0rd!

All requirements satisfied, and it’s less secure than any of the ones I would have put in there otherwise.

[Troon]

@Freman

• Your password must be 8 characters long

Passw0rd!

That’s nine characters long

[CaptTom (Tom)]

Did this already get fixed? I just noticed my Samba Notification Block automation hasn’t blocked anything in two days, nor have I gotten any notifications since then.

That may be around the time I updated Supervisor to 2021.03.03, I don’t recall exactly. I just went to .04 and so far no notifications or automation triggers about passwords yet.

Is it over?

[Edit: No, I finally realized it wasn’t showing up in the logbook because I’d (wisely) excluded the automation from Recorder. No sense filling up yet another log. The password check is already doing enough damage to my SD card, running hourly.]

[danbutter]

I have supervisor-2021.03.4 and still seeing my automation running so it isn’t over… for me anyway.

[pauly7300 (Paul Morley)]

@MDSDM

Everyone knows it should be Steelers

I beg to differ… C0wb0yz96! You probably recall the score…27-17 over the steelers. mohhh ha ha ha ha

[ur7x]

Super strong password!. No one would use Cowbows as a password in the last 20 years.

[BeardDad]

I’m in no way trying to be up in your face about this, but it might give you some peace of mind if you read up on how you’re passwords actually AREN’T harvested:

Validating Leaked Passwords with k-Anonymity

This paragraph explains it nicely:
" Suppose a user enters the password test into a login form and the service they’re logging into is programmed to validate whether their password is in a database of leaked password hashes. Firstly the client will generate a hash (in our example using SHA-1) of a94a8fe5ccb19ba61c4c0873d391e987982fbbd3 . The client will then truncate the hash to a predetermined number of characters (for example, 5) resulting in a Hash Prefix of a94a8 . This Hash Prefix is then used to query the remote database for all hashes starting with that prefix (for example, by making a HTTP request to example.com/a94a8.txt ). The entire hash list is then downloaded and each downloaded hash is then compared to see if any match the locally generated hash. If so, the password is known to have been leaked."

[Bit-River]

I think everyone appreciates that aspect of the check, and the benign nature of the hashing.

What they don’t appreciate is not having the function to:

• Disable / Enable the service
• Mute the warnings partially or totally

The unannounced nature of the change meant the usual super-excitement of release day became super-annoyance at an unrequested, uncontrollable announcement to a third-party business.

---

It has probably not gone unnoticed that HIBP was looking for a buyer in 2019 though that seemed to stall in March last year.

Having a global, intimate, and popular software such as HA checking daily on the service would certainly enhance its value.

Have I Been Pwned? | Unsuccessful effort to sell

/tin-foil

[Dixey]

They’re America’s password…

[rarroyo (Ricardo)]

I vote for an option to disable this. No need to have this on a local, secured network, behind a firewall, with no outside access.
And who’s idea was it to check every hour?
If a password is changed, the supervisor needs to be restarted anyways before it takes effect, so why not check just once when the supervisor starts.

[DavidFW1960 (David)]

@rarroyo

If a password is changed, the supervisor needs to be restarted anyways before it takes effect, so why not check just once when the supervisor starts.

Huh??? Um no it doesn’t

[samnewman86]

@rarroyo

with no outside access.

I guess it’s not a problem as the check won’t reach the 3rs party then?