this post was submitted on 17 Oct 2026
-68 points (14.6% liked)

Selfhosted

63017 readers
1324 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
 

Heads up, if you use home assistant, any credentials in your config have been hoovered up without your knowledge

you are viewing a single comment's thread
view the rest of the comments
[–] KaninchenSpeed@lemmy.blahaj.zone 17 points 19 hours ago (1 children)

it only send the first 5 characters of the sha1 hash, thats pretty much useless for finding the password

[–] socphoenix@lemmy.world 14 points 19 hours ago* (last edited 19 hours ago)

This is such a nothing burger, they’re using those first five to get partial matches then doing the actual checks locally on the hash…

To be transparent: this check isn't new, it has been part of the Supervisor for years. It checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why you're seeing it now. Privacy was a design requirement for this feature from the start, which is why your secrets never leave your system. The Supervisor hashes them locally and sends only the first 5 characters of the SHA-1 hash to Have I Been Pwned. HIBP returns every hash starting with that prefix, and the matching happens on your own instance. You can see exactly what it does here: https://github.com/home-assistant/supervisor/blob/main/supervisor/utils/pwned.py. You are right that our documentation should have explained this, including how to turn it off. We'll get that page updated. ../Frenck