Possible security issue: Fritzbox component is passing username and password in clear in the logs

Hi,

I have noticed recently analyzing the logs that the Fritzbox component is passing the username and password in clear mode when connecting to the device.
This is what I see:

2020-04-13 17:28:14 INFO (SyncWorker_4) [homeassistant.components.fritzbox] Connected to device OrderedDict([('host', '192.168.nnn.nnn'), ('username', 'xxxxx'), ('password', 'xxxxx')])

where the ‘xxxxx’ are indeed the correct username and password.

I do not know if it is an issue in my configuration or not, but I could not find a way to hide this info in the logs. I could clearly suppress the log, but being this at INFO level it would not make much sense.

Any idea?
Thanks.

PS
All my sensible data (IP addr., usernames, passwords, etc.) are in the secrets.yaml file.

1 Like