Hacker News Reader

Comment by lioeters | Hacker News Reader

That's not how privacy works. I don't care what you mind or consider harmless, no tool should be scanning the file system for anything without explicit consent and permission.

Making such a behavior opt-out is malicious, intentionally or not. --pwned=false? Give me a fucking break, so you're pwned by default then. Unbelievable what some developers think they can get away with.

View on HN

Did it scan the file system? Or did users hand over the passwords as part of the application? Because everything else makes it sound like the latter.

The site is called "Have I Been Pwned", thus the cutesy name of the flag...

Perhaps it scans a database and not the file system, but either way, if I see an application gathering passwords and sending remote requests to an unauthorized third party "pwnedpasswords.com" (literally) without my explicit command to do so, then it is acting maliciously by design.

It's a password management system - it's not "gathering" passwords, it is being explicitly given passwords by the user. This is a very important difference! The entire point of the application is that you give it your passwords and it keeps them secure.

The designer felt that "secure" included "is this password already published, online, in a known database breach", which is not an unreasonable interpretation.

The documentation has been clarified. There was a a feature flag. Calling this malicious is just absurd flame-bait.

I understand you're OK with a password managing application making remote requests to a third party without your permission or consent. For me it's unacceptable and unforgivable. We have differing opinions.

My whole point is that this should be "differing opinions" and not "moral condemnation". It's not a mere "difference of opinion" if you consider something unacceptable and unforgivable, or act entitled towards the maintainers of a free, open-source program that doesn't conform to your "opinions."

Home assistant is not a password management system. It's a home automation system. The fact that they added password management features into it does not change what it is. Is your email client a password management system because you enter your password into it?

It wasn't malicious but it wasn't expected.

Reply on news.ycombinator.com