homeassistant

PSA - if you're seeing this message, along with:

"App Advanced SSH & Web Terminal uses secrets/passwords in its configuration which are detected as not secure. See pwned passwords and secrets for more information on this issue."

The translation is that your password (in this example, for the Advanced SSH & Web Terminal app) was found in the Have I Been Pwned database. The link given in the message is to their page on HIBP, so you might infer it, but it's not obvious that's what they are saying by the wording of the message.

It does not necessarily mean your HA system has been compromised, just that the (likely) same password appears there. So, if you use "hunter2" as a password, and someone else used it for a site that was then compromised, you'd get this message for your "hunter2" password.

Obviously, using an easily guessable password, or the same password for multiple services (hey, we've all done it), isn't good security practice; best to change your password. You can ignore this warning if you like, but from a security point of view, it's not a great idea.

I found the message very confusing - I thought it was telling me that I was storing passwords in plaintext somewhere. Well, clearly I am (since HA was able to check it against the HIBP database), but that's not what the message means. The concern is the password was FOUND there.

I'm not sure why they didn't just say something like, "Your password is in the HIBP database, here's a link for more info. You should change it." That's much clearer than "detected as not secure".

I like the idea of this check, though I know not all will agree (given it's sending info out), but I wish the message was clearer.

(Note, they don't actually send the password to HIBP - it is hashed and compared that way, something like that. I don't know the technical details.)