> Anyway. What gets me is like: Password authentication SUCKS. It's a terrible terrible authentication strategy. It's awful. It should not be relied upon. It would be good if humans didn't reuse passwords. But we do. So it sucks.
There's an easy solution for this! Have I been Pwned offers a free API [0] you can use to check if a password has been in a previous breach.
If the password was previously disclosed in a breach, simply inform the user politely "Sorry, this password has previously been previously disclosed and will likely be used by attackers to compromise your account" and make them pick a new one.
No need for 2FA. Simply add a check to prevent users from re-using passwords.
(If you don't want to start sending user passwords to HIBP, you can also download the list and use it internally)