VissViss@mastodon.social
Oct 17, 2026, 8:15 PM@madengineering @Cali @homeassistant yep. if you look at the HA codebase and ask 'how can i solarwinds, or ssh xz backdoor this codebase' suddenly you strike gold in a bunch of places
Replies
Mad Engineeringmadengineering@hachyderm.ioOct 17, 2026, 8:38 PM@Viss @Cali @homeassistant The last time I saw an IT project this dumb was an e-commerce website package that was hard-coded to have a whatever.url/admin address that gave you admin access to the site *even if your login failed*.
Yeah, it got hacked a lot.
- VissViss@mastodon.socialOct 17, 2026, 8:41 PM
@madengineering @Cali @homeassistant well in very large part home assistant is actually a really good thing - it gets people off cloud services, lets people control stuff inside their house without big tech deciding who gets to control what etc
its just this hibp bullshit thats wrong
- Mad Engineeringmadengineering@hachyderm.ioOct 17, 2026, 8:51 PM
@Viss @Cali @homeassistant Back when I worked IT security, my usual description when working with compromised password issues was to remind the hacked user "This is your new temporary password, you can change it, but please don't use the old one, hackers know that one now. "
I think this would be the appropriate action with HIBP, remind people in the password field that "A large number of passwords are already known by hackers, and if you use one of them, well, you're going to get hacked. Click here for more information."
- VissViss@mastodon.socialOct 17, 2026, 8:54 PM
@madengineering @Cali @homeassistant there are a bunch of ways to handle this scenario, but one thing we can all agree on is:
the way it is currently being handled is an example of the wrong way to do it