PSA - if you're seeing this message, along with:
"App Advanced SSH & Web Terminal uses secrets/passwords in its configuration which are detected as not secure. See pwned passwords and secrets for more information on this issue."
The translation is that your password (in this example, for the Advanced SSH & Web Terminal app) was found in the Have I Been Pwned database. The link given in the message is to their page on HIBP, so you might infer it, but it's not obvious that's what they are saying by the wording of the message.
It does not necessarily mean your HA system has been compromised, just that the (likely) same password appears there. So, if you use "hunter2" as a password, and someone else used it for a site that was then compromised, you'd get this message for your "hunter2" password.
Obviously, using an easily guessable password, or the same password for multiple services (hey, we've all done it), isn't good security practice; best to change your password. You can ignore this warning if you like, but from a security point of view, it's not a great idea.
I found the message very confusing - I thought it was telling me that I was storing passwords in plaintext somewhere. Well, clearly I am (since HA was able to check it against the HIBP database), but that's not what the message means. The concern is the password was FOUND there.
I'm not sure why they didn't just say something like, "Your password is in the HIBP database, here's a link for more info. You should change it." That's much clearer than "detected as not secure".
I like the idea of this check, though I know not all will agree (given it's sending info out), but I wish the message was clearer.
(Note, they don't actually send the password to HIBP - it is hashed and compared that way, something like that. I don't know the technical details.)
There is an option to disable it through the
haCLI if wanted; https://github.com/home-assistant/home-assistant.io/issues/49314#issuecomment-6224767556As an aside, that issue doesn't really reflect well on HA or frenck.
The way Frenck handled the tone initially was mostly okay, though he really should have properly addressed the concern with details as he did in his final comment. The comments in between are pretty dismissive, I agree.
That said, there’s no real issue of information being leaked. The first 5 characters of a hash are all but useless to an attacker. Admittedly, it does raise the attack surface very slightly, and should be opt in instead of opt out. Or at the very least be enabled by default and presented during onboarding.
That said, there’s way this works doesn’t ring any alarm bells to me.
Of course, it already happened, unless you literally just installed. If you read the last comment closely, the feature to check HIBP has been there for a while, but the message about it was blocked until recently. So if you really didn't want to do this check.... Well, too bad, it's done.
I love HA, but the messaging is not always great. There was a new feature a while back that had a lot of people upset (I'm pretty sure it was automatically encrypting all backups), and the developers just kept saying, "It was in the release notes." I always review the release notes before installing, and I definitely missed that, so I went back to read them with that in mind, and I still couldn't find it. After a few minutes, I realized it was in there, sort of - it was just implied, not explicitly stated. Why not just say, "HA will now encrypt backups by default"?
I've actually had training in using plain language in business writing, so maybe it's just more obvious to me. Unfortunately, I do not have the time to help that much, and we'd have to convince them there is an issue there, first.