I do get the sense that you're not malicious, just that maybe you're not seeing this from the standpoint of someone that assigns a higher value to some elements of privacy. In this case, your user base expects a home automation system. They do not expect that system to scan their computer for passwords, regardless of how "safely" the home automation system were to behave.
You might have a heart of gold, and just be having an off day due to reasons, so I hope people cut you some slack, but if I were you I'd update this feature to be opt-in and conspicuous, immediately
I've not seen the claim that it is scanning their computer for passwords. My understanding is the ones it checks are those that are used in HA's config (I assume, for different devices it connects to in your home).
There are a lot of problems with poor security practices devices of this type. Maybe the feature is a bit too paternalistic but it is not malicious.
I still agree its not the right default but thats quite a lot less invasive than you are making it sound.
My concern is Supervisor runs the operating system for the computer Nabu Casa sold me to run HAOS.
In the off chance Supervisor inadvertently revealed the first 5-characters of my password hash to something else on or off my network over the years, I’m now going to spend a weekend reinstalling a fresh copy of HAOS, blocking it from Internet access until I can run the command to disable this, issuing new passwords and accounts to my household, and resetting the passwords for all my devices and integrations, then restoring all my automations.
Better documentation will definitely help restore confidence, but good practice for me to cycle all my passwords and tighten network policies anyways.
It's the first 5 chars of the SHA, nto first 5 chars of the PW - this is a common pattern and how all HIBP integrations work (including the ones built into all major password managers nowadays).
in defense of frenck, this is actually a very secure way to perform the task. swiss cheese alignment won't happen because of this
however
it's also a feature transmitting information in a product that bills itself as being offline. imo it's a (minor) privacy violation, not a security violation.
> swiss cheese alignment won't happen because of this
This is the problem. You do not know what you do not know. There have already been papers written about the problems with HIBP. You don't have to understand the threat model for it to exist.
It's not just a home automation system though. People setup HA for a lot of reasons, but one of them is that they don't want other people/companies in control of what goes on in their home, spying on them, etc. The sort of people who go to the trouble to set up a server, deal with all of the integration issues, etc so that they can get something that they have control over of.
Anyhow that sort of person might not take kindly to having a hash of their password sent to some random web server without being asked first.
Depending on how it's batched, this tells HIBP (and any MITM -- even one that can only see ciphertext) roughly how many unique passwords you use. Knowing the 5-character hash prefix also cuts down brute force attacks by a factor of a million -- though in practice this is only a real issue if you use one of the compromised passwords (there's only a few hundred candidates per prefix), in which case you're kind of screwed already because they're probably in dictionaries anyway.
I don't think these are /critical/ issues and the latter is basically just an argument against the HIBP service, but the point is that a user should opt-in to sharing their data in cases like this so they have a chance to make an informed decision. The k-anonymity design of the HIBP service has a degree of anonymity, it's not "provably anonymous" like homomorphic encryption or similar schemes would be.
Does it actually batch them in an identifying way?
Is there any realistic value to knowing "how many unique passwords you use"? If you already have one of my passwords compromised, you'd presumably try it on the rest of my accounts regardless?
My browser fingerprint leaks, what, thousands of times more information than that - surely fixing applications like Chrome to have sensible privacy-preserving opt-in-only behavior is vastly more important than nagging some obscure open source software about an edge case that can barely be exploited?
By "batching" I was referring to whether they deduplicate requests -- if they do one HTTP request for every password then you get some extra information about how passwords are shared that you would have to infer otherwise.
If you know someone with N logins has N passwords it's a decent indication they use a password manager and so passwords are unlikely to be weak, if they have 1 password it's probably shared elsewhere and weak.
I also wasn't responding to a question asking about practical exploits, I was responding to a question that claimed the k-anonymity model is "provably anonymous" and "harmless". Since it clearly leaks some information it's definitely not the former and one could argue it's not the later though the "harm" is minimal.
> My browser fingerprint leaks, what, thousands of times more information than that - surely fixing applications like Chrome ...
I fail to see how the privacy nightmare of modern browsers is relevant to a discussion on whether opt-out signalling to third-party services is a reasonable stance for an open source project? By that metric no privacy bug is worth reporting because Chrome continues to exist. If only there was a term for this kind of non-sequitur...
If you want to claim something is harmful, you have to actually demonstrate that harm. Otherwise your claim is merely that it could be harmful, which is by default true of basically everything, and thus not a very interesting point.
"Leaks information" is perfectly compatible with "provably anonymous"
You have to prove that the leak is enough to actually de-anonymize someone to disprove anonymity.
I'm not saying it can't be done, but you're jumping ahead and skipping a very important step.
Even sending out a request to a third party server without any input by the user or good reason (which I wouldn’t count this as) should be counted as a privacy violation because HIBP can now infer that network is running HA.
By a virtue of the fact that each and every server logs all packets 24/7 nowadays. For example, if you run a port scanner over a million different IP addresses, and one of them happens to be mine, then in my logs there is your IP now.
Yes, but how do you go from "I got pinged by this IP" to "this network is running HA, and not one of a dozen of other tools that tend to ping this IP"?
The claim wasn't that they have the IP address - that's useless on it's own. The claim was that this somehow establishes it as an HA account
Okay, but (a) it's a well known, trusted service and (b) yeah, my browser does that every time I visit a site but no one seems to freak out about that. Like... an IP address by itself is useless, and it's being handed to a trusted party anyway...
The purpose of a browser is to make network requests. If I use a browser, I am implicitly giving it consent to make the network requests necessary for the web browsing I do.
This implied consent does not cover unnecessary requests, e.g. the adverts Firefox displays on new tabs by default are unacceptable, because I did not consent to them being downloaded. It also does not cover the network requests made by opening the "Extensions and Themes" menu, because merely looking at a configuration menu does not imply consent to make network requests.
But that fact that modern web browsers are a privacy disaster does not excuse bad behavior from other software.
That's not how privacy works. I don't care what you mind or consider harmless, no tool should be scanning the file system for anything without explicit consent and permission.
Making such a behavior opt-out is malicious, intentionally or not. --pwned=false? Give me a fucking break, so you're pwned by default then. Unbelievable what some developers think they can get away with.
Perhaps it scans a database and not the file system, but either way, if I see an application gathering passwords and sending remote requests to an unauthorized third party "pwnedpasswords.com" (literally) without my explicit command to do so, then it is acting maliciously by design.
It's a password management system - it's not "gathering" passwords, it is being explicitly given passwords by the user. This is a very important difference! The entire point of the application is that you give it your passwords and it keeps them secure.
The designer felt that "secure" included "is this password already published, online, in a known database breach", which is not an unreasonable interpretation.
The documentation has been clarified. There was a a feature flag. Calling this malicious is just absurd flame-bait.
I understand you're OK with a password managing application making remote requests to a third party without your permission or consent. For me it's unacceptable and unforgivable. We have differing opinions.
My whole point is that this should be "differing opinions" and not "moral condemnation". It's not a mere "difference of opinion" if you consider something unacceptable and unforgivable, or act entitled towards the maintainers of a free, open-source program that doesn't conform to your "opinions."
Home assistant is not a password management system. It's a home automation system. The fact that they added password management features into it does not change what it is. Is your email client a password management system because you enter your password into it?
people do need the option to repair devices, especially when they contain valuable information, so I don't see an automatic bricking to be a reasonable solution
The word for crypto device self destruction military guys use is zeroize. It can be triggered manually or automatically. A zeroized device can be repaired and signed off by a trusted person, then a new key loaded by another person.
Maybe these devices could ship in a tamper-detection-only mode, then detection triggered by user to be inspected by the user, then factory installed firmware wiped and reloaded if desired, have user key loaded to the firmware, and the shell sealed back up with electronic and physical detection enabled.
There's a medium. Something ironically close to apple's 'non fully approved and supply chained repair' thing (especially when we consider the case of a screen that could be OCRing data and tossing it out later).
'You have unexpected components. You may want to have your device inspected or risking compromise of x/y/z. Should we continue or lock it down'?
I would love to know if I can use one of this to get unlimited data worldwide.
Jokes aside, keystone wallets are air gapped. And not air gapped but awesome the lesser known but imo best of all, gridplus lattice1.
Heck, even a trezor, despite their mail provider being hacked, is better.
I, however, dont endorse the iPhone idea.
Just don’t buy ledger, terrible company. Many of my friends are getting endless spam because of them. The key backup is a disaster after they promised it was not possible to retrieve it. Their software stack is closed source.
This is imo the last nail in the coffin for them. They should refund all the money lost, and issue a worldwide recall.
There isn't one, that's sort of the thing. The invisible hand of downvotes is the only thing indicating that in the thread, and thus only indirectly. We only have two choices, a magical tampering detector that bricks the whole thing (maybe desirable for some applications, if it never false positive'd), or, the vulnerability.
I'm not even sure a tampering detector would help. If this can happen, I'm fairly sure someone would figure out how to do the ocr by appending components externally.
Other areas of the world have had similar responses to foreign commercial fishing:
>> In Southeast Asia, as competition for fish and other maritime resources intensified following the Asian Financial Crisis in 1997-1998, increases in industrial fish catch volumes by foreign fleets led to sharp increases in South China Sea pirate attacks organized by residents of villages reliant on small-scale fisheries
>> Piracy is a growing concern in Sierra Leone, particularly in the northern maritime areas. Foreign trawlers have been attacked and robbed of both their catch and personal effects. Most of the pirates are reported to be from Guinea.
However, there is evidence that piracy is more likely to exist in places where illegal fishing has declined. (With the disclaimer that "this research does not refute the earlier-held notion that foreign trawlers produce dissatisfied local fishers who turn towards piracy as a defense against foreign intruders."
Destroying 450 out of 130,000, ie 0.3%, is not sufficient to resist the imposition of a surveillance state. Americans pretty clearly do not care for freedom as much as they yap about.
I don't think it's that simple... the vast majority of people simply don't know what having Flock means in the first place besides "less crime".
They don't understand how it could personally affect them and hence why they should care.
The "nothing to hide" crowd never thinks about data harvesting, leaks, hacks, malware, viruses, corrupted employees or other threat actors using the data maliciously.
Manipulating leaked/stolen data is also an extremely easy way to frame someone because the accuracy of the data is almost never questioned.
Ideal outcome in theory but let's be realistic here, change through voting takes years to propagate through a political system while corporate buildouts can take place within months.
First you have to vote out all the representatives that voted for the cameras. Then you have ensure the replacements vote to remove them. then you have to be prepared for potentially years of litigation and negative PR campaigns. And that's just on one issue. Many politicians will correctly decide that it's easier to take corporate cash and kiss more babies and get sent back to office anyway.
we need to stop relying on representative democracy. It worked somewhat OK during periods of technological stasis or relatively sedate change, but it's absolutely inadequate to teh challenges of the digital era. Sortition or electronic democracy are the only credible alternatives.
When I search google, using his name, the AI generated content at the top works.. if I ask what comment he left, suddenly the AI generated content stops working.
A fascinating read, and very timely, thank you for sharing. If ever there was an argument against “too many people would have to keep quiet” this is it. Sickening.
You might have a heart of gold, and just be having an off day due to reasons, so I hope people cut you some slack, but if I were you I'd update this feature to be opt-in and conspicuous, immediately
reply