

The comparison is done by hashing your password, sending some of the first few characters of the hash to HIBP, receiving hashes that match that pattern, then locally comparing the full hashes.
So there’s no concern that credentials are being leaked (despite the other post earlier this month insisting HA was leaking all your secrets) as you can’t really leak a password with a partial hash (you can narrow an attack surface very slightly, I admit), and all actual true comparisons are done locally.




The way Frenck handled the tone initially was mostly okay, though he really should have properly addressed the concern with details as he did in his final comment. The comments in between are pretty dismissive, I agree.
That said, there’s no real issue of information being leaked. The first 5 characters of a hash are all but useless to an attacker. Admittedly, it does raise the attack surface very slightly, and should be opt in instead of opt out. Or at the very least be enabled by default and presented during onboarding.
That said, there’s way this works doesn’t ring any alarm bells to me.