A built-in Home Assistant feature quietly checks stored secrets against breached-password records, prompting complaints over transparency and consent despite its privacy-preserving design.
A Home Assistant user has discovered that the platform can check whether stored secrets match passwords already exposed in breaches, after an alert appeared while testing the Samba Share add-on. The warning, shown in Swedish, flagged insecure secrets in the add-on configuration and pointed the user to Home Assistant’s documentation on pwned passwords and secrets. The discovery turned what looked like a routine configuration change into a reminder that Home Assistant has built-in security checks that many users may not notice until they are triggered.
According to Home Assistant’s own documentation, the feature works by hashing stored secrets and comparing them with the Have I Been Pwned database without revealing the original password. The project says this approach relies on K-anonymity, a privacy-preserving method that allows a partial hash to be checked against a breach dataset while keeping the full secret hidden. If a match is found, Home Assistant warns the user and recommends replacing the compromised value as soon as possible.
The same service is also used in a separate Home Assistant integration that monitors email addresses for breaches. That integration requires users to add it to configuration.yaml, supply the addresses to be checked and enter an API key from Have I Been Pwned. Once enabled, it reports breach counts for each address and is intended as an ongoing alerting tool rather than a one-off scan.
Not everyone has welcomed the feature, however. A recent complaint highlighted on GitHub argued that the Supervisor component was inspecting application secrets without explicit permission, even though the values were hashed before being checked. The same discussion raised concerns about transparency, consent and whether users understood that the behaviour was happening by default. Another issue on GitHub reported difficulty disabling password checks, while a separate write-up said a maintainer later apologised after criticism and confirmed that the feature can be turned off with a single command. The episode underlines a familiar tension in security software: measures designed to protect users can still cause friction if they are not clearly explained or easily controlled.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
