Say why the OTA password should go

esphome/components/esphome/ota/__init__.py

@@ -131,14 +131,15 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
             _resolve_encryption_key(encryption_conf, api_conf)
         elif CONF_PASSWORD in ota_conf and _api_static_key(api_conf) is not None:
             _LOGGER.warning(
-                "The '%s' %s %s also authenticates OTA uploads and encrypts them, "
-                "so '%s' %s only guards plaintext uploads; remove '%s' and add "
-                "'%s' under '%s' to require encryption",
+                "'%s' %s wastes flash and RAM: the '%s' %s %s already authenticates "
+                "and encrypts OTA uploads, the password only serves older clients "
+                "that do not support encryption; remove '%s' and add '%s' under "
+                "'%s' to require encryption",
+                CONF_OTA,
+                CONF_PASSWORD,
                 CONF_API,
                 CONF_ENCRYPTION,
                 CONF_KEY,
-                CONF_OTA,
-                CONF_PASSWORD,
                 CONF_PASSWORD,
                 CONF_ENCRYPTION,
                 CONF_OTA,

tests/component_tests/ota/test_esphome_ota.py

@@ -357,7 +357,7 @@ def test_password_with_api_key_warns(caplog: pytest.LogCaptureFixture) -> None:
     try:
         with caplog.at_level(logging.WARNING):
             ota_esphome_final_validate({})
-        assert any("only guards plaintext" in r.message for r in caplog.records)
+        assert any("wastes flash and RAM" in r.message for r in caplog.records)
     finally:
         fv.full_config.reset(token)
 
@@ -379,7 +379,7 @@ def test_password_without_static_api_key_no_warning(
     try:
         with caplog.at_level(logging.WARNING):
             ota_esphome_final_validate({})
-        assert not any("only guards plaintext" in r.message for r in caplog.records)
+        assert not any("wastes flash and RAM" in r.message for r in caplog.records)
     finally:
         fv.full_config.reset(token)