I wouldn't be surprised if that integration is outright illegal in EU due to GDPR, thus putting HIBP in trouble for ingesting PII without any legal legitimacy.

And the first reply being "It is not an invasion of privacy" just shows incompetence on privacy topics. It is never a valid answer.

Which is really concerning, for the lead developer of a home automation system that "fights for the fundamental principle of privacy" as per their mission statement.

▲ n42 14 minutes ago | parent | next [-]

  It is not an invasion of privacy

this rubbed me the wrong way.

absolutely no one but me gets to decide what is an invasion of my privacy.

▲ Matticus_Rex 2 hours ago | parent | prev | next [-]

It's certainly an overstep, but just the hash they're sending wouldn't be PII.

	▲	Rygian 2 hours ago \| parent [-]
		The hash itself is irrelevant. The question is what PII does HIBP collect on submission (eg IP address), and with whose consent, and for which purposes? All that should be explained in excruciating detail in the ticket and in the documentation, to begin with.

▲ deadbunny 2 hours ago | parent | prev | next [-]

What PII do you think is being sent to HIBP?

▲ nicce 2 hours ago | parent | prev [-]

I am curious thought that how it would be illegal according to GDPR. They are hashed after all, and the same hash is not used for authentication.

	▲	Rygian 2 hours ago \| parent [-]
		Undoing personal information for a purpose different than the purpose for which it was collected.