@madengineering @Cali @homeassistant well in very large part home assistant is actually a really good thing - it gets people off cloud services, lets people control stuff inside their house without big tech deciding who gets to control what etc
its just this hibp bullshit thats wrong
@Viss @Cali @homeassistant Back when I worked IT security, my usual description when working with compromised password issues was to remind the hacked user "This is your new temporary password, you can change it, but please don't use the old one, hackers know that one now. "
I think this would be the appropriate action with HIBP, remind people in the password field that "A large number of passwords are already known by hackers, and if you use one of them, well, you're going to get hacked. Click here for more information."
@madengineering @Cali @homeassistant there are a bunch of ways to handle this scenario, but one thing we can all agree on is:
the way it is currently being handled is an example of the wrong way to do it