Login
You're viewing the dmv.community public feed.
  • VissViss@mastodon.social
    Oct 16, 2026, 8:42 PM

    @hannukle

    heres the super short version:
    - anything that scans secrets and sends them off the system NEEDS TO BE AN OPT IN SYSTEM.
    - grabbing secrets off a system and sending them elsewhere without consent is tantamount to infostealer behavior / malware behavior
    - putting this system into production and sending it to EVERY HA INSTALL IN THE WORLD is similar to the solarwinds breach
    - now every HA install in the world has plumbing inside of it that can be trivially abused.

    it is NOT OK

    💬 2🔄 2⭐ 8

Replies

  • VissViss@mastodon.social
    Oct 16, 2026, 8:43 PM

    @hannukle

    *ANY SCENARIO* where a system is ACTIVELY SCANNING FOR CREDENTIALS needs to be an opt-in system

    EXPRESSLY because it can be abused

    look at the solarwinds breach
    look at the ssh xz backdoor

    this is security 101

    💬 1🔄 1⭐ 4
  • Hannu Khannukle@infosec.exchange
    Oct 16, 2026, 8:50 PM

    @Viss I have to disagree here though I don't know the details how HA has implemented this. I think it's best practice for internet-facing services to try identifying bad passwords and HIBP is probably the best way to do it. Implementation doesn't send secrets over the wire. If implemented correctly password isn't available for checking other than user logging in or user changing password. Then password is inputted in plain text and it's pretty trivial to check this with HIBP using k-anonymity. Also NIST 800-63B requires identifying bad passwords indicating it's good practice to prevent using such passwords.

    💬 2🔄 0⭐ 2
  • Hannu Khannukle@infosec.exchange
    Oct 16, 2026, 8:51 PM

    @Viss HA shouldn't be internet-facing so I don't think it's high priority to checl this, but having vast automation and IoT access I can understand why they want to implement this.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 3
  • queerinmechqim@mas.to
    Oct 16, 2026, 10:27 PM

    @hannukle i get that this is not your area of expertise but the people who have it are in this thread freaking out, so you should take that into consideration

    the number of ways this can be abused is actually huge, i cannot list them all but as a couple examples:

    (1) hashes are not fully opaque, and even having just the first few characters will radically narrow the search space making password cracking that was previously unfeasible into a trivial task

    (2) if a trusted program is scanning secrets and sending some portion of them anywhere then it it trivial for a threat actor to alter that code to do something malicious

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0