Home Assistant用户在GitHub上报告称系统未经授权自动启用了密码泄露检查功能1。该功能会扫描用户的密码配置并将哈希值发送至Have I Been Pwned服务1。
项目维护者Frenck随后澄清，这项检查功能已在Supervisor中存在多年，并非新增功能1。维护者指出，用户可以通过命令 ha security options --pwned=false 将其关闭1。该功能仅在最近版本中才开始显示警告提示1。
密码处理过程遵循隐私设计原则1。密码从不离开用户本地系统，仅经过本地哈希处理后，发送前五个字符至Have I Been Pwned服务1。这一做法采用了K匿名技术确保隐私保护，与1Password等主流密码管理器的实现方式相似1。维护者为早期回复态度冷淡道歉，并承诺更新文档以说明该功能的具体工作原理和关闭方法1。
A Home Assistant user raised concerns on GitHub about a password breach-checking feature that was automatically enabled without explicit authorization 1. The feature scans user password configurations and sends hashed data to the Have I Been Pwned service 1.
Project maintainer Frenck clarified that the functionality has existed for several years as part of the Supervisor and can be disabled via the command line using ha security options --pwned=false 1. Passwords never leave the user's system; instead, they are hashed locally, and only the first five characters are sent to Have I Been Pwned 1. This approach employs k-anonymity techniques to preserve privacy, similar to the methodology used by password managers like 1Password 1. The warning about this feature only began appearing in recent versions of the software 1.
In response to the discussion, the maintainer apologized for an initially dismissive reply and committed to updating documentation to better explain the feature and how to disable it 1.
评论
还没有评论，欢迎留下第一条。