What I do:
1. Check the password against the haveibeenpwned.com database.
2. Check the password with the zxcvbn password strength library.
If it passes both they can use it. It's not perfect, but it's a lot better than nothing.
1. Check the password against the haveibeenpwned.com database.
2. Check the password with the zxcvbn password strength library.
If it passes both they can use it. It's not perfect, but it's a lot better than nothing.
I built a toy webpage using the API [2], and you can see how straightforward the API is to use by checking the script [3].
[1] https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR...
So for: * Password: trustno1 * Hash: 1234567890abcdefghij
You send to the api:
* Hash: 12345
And it returns all hashes it knows of that start with 12345 along with a count of how many times each hashed password has been breached.
You then compare that list to see if your full hash exists in there.
If it exists - it's been breached. If not - you're clear.
It's about checking a "new" password when an account is created, or the password changed.
Having said that - I don't see any issue with checking current passwords when the user logs in - you don't send the password to the remote service, so it can't leak that way.
Turns out he's downloaded a hashed list and is checking against that. Which is fine.
I'm using Active Directory and options for extra password checks are somewhat limited.
https://docs.microsoft.com/en-us/azure/active-directory/auth...
It lets you upload your own custom list of banned passwords but it's limited to 1000 words. My impression is that this is intended to blacklist common words and things like your company name.
I see that Troy Hunt is now working for Microsoft so perhaps there's something in the works related to this. It seems like linking this Azure AD service to the haveibeenpwned API would be pretty straightforward.