So, wait, these are secrets that are already given to h-a, hashed, and just the first five characters of the hash sent up..?

Yeah, I agree with the maintainer, this strikes me as outrage theater over any actual problem, no?

People herr act like HA includes a script that collects every password on your computer and sends them all over plaintext HTTP. I'm disappointed to be honest.

I would like to see the write-up from the red teamer and white hat hacker that claim they could break into thousands of systems with five characters of a SHA hash of a password. Should be a fun read.