Home Assistant, the popular open-source home automation platform, has been quietly scanning user-configured passwords against the Have I Been Pwned breach database for years via its Supervisor component. The feature hashes passwords locally, sends the first five characters of the SHA-1 hash to HIBP's k-anonymity API, and matches results on the local instance. A recent release fixed a warning display bug, which surfaced the behavior to users who had no idea it was happening. The issue was raised on GitHub by Dan Tentler (Viss), founder of Phobos Group and a former Twitter red-team member, who called it a 'severe invasion of privacy.' His objection was not about the cryptographic mechanism — he is well-acquainted with HIBP and k-anonymity — but about consent. No user opted into this scan. No documentation explained it existed. No toggle was surfaced in the UI. The initial response from Frenck, a core Home Assistant team member, was dismissive to the point of hostility. He declared the issue 'closed as won't fix,' told users that threats to fork were 'not statements we can work with,' and locked the thread as 'too heated.' When a second user asked how to disable the feature and requested it be made opt-in, Frenck's response amounted to a shrug emoji. To his credit, Frenck later returned with a substantive follow-up and an apology. He acknowledged his earlier replies were 'more dismissive than this deserved,' revealed the opt-out command (ha security options --pwned=false), pointed to the exact source code implementing the check, and committed to updating documentation. The reversal was meaningful — but it came only after the thread was locked and the damage to trust was done. The technical implementation is genuinely privacy-preserving. K-anonymity means HIBP never sees the full hash, only a five-character prefix. Matching occurs entirely on the user's own instance. The code is open and auditable. By the standards of password breach-checking services, this is best practice. But best-practice cryptography does not substitute for consent. The deeper issue is governance. Home Assistant markets itself as a privacy-first, local-control alternative to cloud-dependent smart home platforms. Its entire value proposition rests on the idea that your data stays on your hardware. When the project silently initiates outbound network requests containing derivative data from user secrets — regardless of how well those requests are anonymized — it undermines the trust model that justifies the platform's existence. The feature may be benign in isolation, but the pattern of shipping silent telemetry, dismissing complaints, and locking dissent is corrosive. The episode is a textbook case of open-source maintainer burnout colliding with legitimate user concerns. Frenck's initial response reads like someone who has fielded too many bad-faith complaints and pattern-matched a genuine security professional's objection into the 'entitled user' bucket. The correction matters. But the first response is what users experienced, and for a project whose brand is user sovereignty, the cost is real.
