Home Assistant User Raises Privacy Concerns Over Secret Scanning Feature

Unauthorized Secret Scanning Reported

A Home Assistant user opened an issue on GitHub, expressing concern over an integration that appeared to be scanning their secrets without explicit authorization. The user stated they had not enabled any such plugins or integrations and viewed the activity as a significant privacy invasion, particularly the transmission of data, even if hashed, to external services.

Home Assistant's Response and Clarification

Home Assistant developers responded, clarifying that the secret scanning functionality is not new and has been part of the Supervisor for several years. They explained that the system checks application options marked as passwords, hashes them locally, and only sends the first five characters of the hash to the Have I Been Pwned (HIBP) service. This design was implemented with privacy as a core requirement, ensuring secrets do not leave the user's system.

Disabling the Feature

Initially, the user sought a way to disable the feature. Home Assistant confirmed that the check can be turned off using the command line: `ha security options --pwned=false`. The recent visibility of this feature was attributed to a fix in a warning mechanism, not a new deployment of the scanning itself.

User's Continued Concerns

Despite the explanation, the user, identifying as a security professional with experience in red teaming and password management deployments, reiterated their dissatisfaction. They argued that such a feature should be opt-in rather than enabled by default, citing potential abuse vectors for malicious actors.