TechnologyFriday, October 16, 20265 min read

I never authorized an integration that scans my secrets

By Hacker News · Published by Everything Blog

In short

A recent article highlighted a feature in Home Assistant that scans for and shares user secrets with HIBP, exposing significant privacy risks. This unauthorized integration poses a threat that could be exploited by malicious actors, potentially leading to the exposure of sensitive information. The article suggests an opt-in feature to ensure user consent and privacy. The issue has been closed as "won't fix," indicating it is not being addressed in the current system.

Key points

The unauthorized integration poses a threat that could be exploited by malicious actors.: The unauthorized integration poses a threat that could be exploited by malicious actors.
The issue has been closed as "won't fix," indicating it is not being addressed in the cur…: The issue has been closed as "won't fix," indicating it is not being addressed in the current system.
The article suggests an opt-in feature to ensure user consent and privacy.: The article suggests an opt-in feature to ensure user consent and privacy.

You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert

{{ message }}

Repository navigation

i never authorized an integration that scans my secrets #49314

Other (issue in content formatting, broken link or image, non-working widget)

Problem description

This is a pretty severe invasion of privacy.

I never authorized any integrations or plugins for scanning secrets and sending them up the line, even if they are hashed or not.

This mechanism could be abused by a malicious threat actor with access to the home assistant github repos in a variety of ways.

how do i turn this thing off?

Suggested solution

make this an opt-in feature, do not just opt people in to scanning for secrets with a system they were not aware existed.

It is not an invasion of privacy and there are sure other apps out there doing this (most notably the 1Password password manager). Your passwords are never send out, never published.

I run Phobos Group, and I travel all over the world giving presentations about security.

I am very well acquainted with HIBP, and have met troy in the past.

I helped deploy 1password at twitter when I was their sole red-team staff member in 2011.

I am still not happy that home assistant, without my opt-in, without my permission, scanned my HA installation and send stuff up the line to HIBP.

This should be an opt-in feature, and not something that 'just happens'.

As a red teamer, I can give you a list as long as my arm about how I could abuse this to loot credentials from every HA install on the planet.

Hi, long time HA user here. Please re-open this issue and address the question of how to disable this. If a method to disable it is not currently implemented, please consider implementing this rather than insisting the userbase accept this and take your word on it. This response feels extremely dismissive and as a user of this platform I feel secondhand offended by it as I share the exact same concerns as OP and do not believe the response here adequately addressed the concerns.

If there is no interest in addressing this reasonably, please let us know so we can uninstall and fork.

Sorry, these are not statements we can work with. Doing such threats and trying to intimidate it not going to bring you anywhere. If you want to do a feature request, that is fine, we have places for that.

This report is on our documentation. There is no amount of documentation I can adjust to adjust this or address this. Thus closed as won't fix.

If this is all reason for you to uninstall and fork... 🤷 So be it, it is open source after all.

Activity

frenck commentedon Oct 16, 2026

Oh hi there 👋

It is not an invasion of privacy and there are sure other apps out there doing this (most notably the 1Password password manager). Your passwords are never send out, never published.

Read more about it here: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/

As a matter of fact, it is designed to handled these types of data with privacy in mind, see also: https://en.wikipedia.org/wiki/K-anonymity

If anything, learn from the output, because the secrets you are using are listed in the password databases and thus easily "hackable".

../Frenck

Blogging my personal ramblings at frenck.dev

Viss commentedon Oct 16, 2026

I run Phobos Group, and I travel all over the world giving presentations about security.

I am very well acquainted with HIBP, and have met troy in the past.

I helped deploy 1password at twitter when I was their sole red-team staff member in 2011.

I am still not happy that home assistant, without my opt-in, without my permission, scanned my HA installation and send stuff up the line to HIBP.

This should be an opt-in feature, and not something that 'just happens'.

As a red teamer, I can give you a list as long as my arm about how I could abuse this to loot credentials from every HA install on the planet.

Viss commentedon Oct 16, 2026

this issue is not closed until I am satisfied that HA is not taking things off my system without my permission and sending them to a 3rd party

frenck commentedon Oct 16, 2026

This issue is closed as won't fix. Sorry.

../Frenck

0x00string commentedon Oct 16, 2026

Hi, long time HA user here. Please re-open this issue and address the question of how to disable this. If a method to disable it is not currently implemented, please consider implementing this rather than insisting the userbase accept this and take your word on it. This response feels extremely dismissive and as a user of this platform I feel secondhand offended by it as I share the exact same concerns as OP and do not believe the response here adequately addressed the concerns.

If there is no interest in addressing this reasonably, please let us know so we can uninstall and fork.

frenck commentedon Oct 16, 2026

Sorry, these are not statements we can work with. Doing such threats and trying to intimidate it not going to bring you anywhere. If you want to do a feature request, that is fine, we have places for that.

This report is on our documentation. There is no amount of documentation I can adjust to adjust this or address this. Thus closed as won't fix.

If this is all reason for you to uninstall and fork... 🤷 So be it, it is open source after all.

../Frenck

Blogging my personal ramblings at frenck.dev

troed commentedon Oct 16, 2026

Yes. Yes it is.

/whitehat hacker

Original source: github.com

AI Analysis

Tone

Negative

In short

A recent article highlighted a feature in Home Assistant that scans for and shares user secrets with HIBP, exposing significant privacy risks. This unauthorized integration poses a threat that could be exploited by malicious actors, potentially leading to the exposure of sensitive information. The article suggests an opt-in feature to ensure user consent and privacy. The issue has been closed as "won't fix," indicating it is not being addressed in the current system.

Key Points

The unauthorized integration poses a threat that could be exploited by malicious actors.: The unauthorized integration poses a threat that could be exploited by malicious actors.
The issue has been closed as "won't fix," indicating it is not being addressed in the cur…: The issue has been closed as "won't fix," indicating it is not being addressed in the current system.
The article suggests an opt-in feature to ensure user consent and privacy.: The article suggests an opt-in feature to ensure user consent and privacy.

Topics

Technology

AI Analysis

Tone

Negative

In short

A recent article highlighted a feature in Home Assistant that scans for and shares user secrets with HIBP, exposing significant privacy risks. This unauthorized integration poses a threat that could be exploited by malicious actors, potentially leading to the exposure of sensitive information. The article suggests an opt-in feature to ensure user consent and privacy. The issue has been closed as "won't fix," indicating it is not being addressed in the current system.

Key Points

The unauthorized integration poses a threat that could be exploited by malicious actors.: The unauthorized integration poses a threat that could be exploited by malicious actors.
The issue has been closed as "won't fix," indicating it is not being addressed in the cur…: The issue has been closed as "won't fix," indicating it is not being addressed in the current system.
The article suggests an opt-in feature to ensure user consent and privacy.: The article suggests an opt-in feature to ensure user consent and privacy.

Topics

Technology

Anthropic's IPO Prospectus Is a Fucking Doozy
Anthropic's IPO prospectus presents a colossal bet on AI's transformative power, positioning the company as the front-runner in a race to create a godlike superintelligence. The prospectus details a net loss of $42 billion in 2025 and plans to spend $518 billion on cloud, computing, and infrastructure obligations in the coming years. While the company reported a net loss of $8 billion on an operating basis in 2025, it's unclear how they plan to generate profits.
2 min read
Codex Pricing: Pro has unlimited 5.6 usage
Codex Pricing: Pro offers unlimited 5.6 usage, providing users with extensive flexibility and potential to exceed their data limits without additional costs. This feature is particularly beneficial for users who frequently exceed their data allowances, ensuring they can continue to enjoy the benefits of the service without interruption.
1 min read
Replit is no longer working with Anthropic, CEO says
Replit, the AI coding platform, has announced a significant change in its partnership with Anthropic, the company's CEO and co-founder, Amjad Masad. The decision was made due to cost considerations and Masad's assessment that the partnership was not the best fit for Replit's current needs. Replit's previous partnership with Anthropic helped the company grow, but Masad emphasized that enterprise revenue is now a larger contributor, and the company is focusing on creating a better environment for AI agents to thrive.
2 min read