They sure do and in fact offer an API for sites to validate sha-1 hashes against their cracked password DB[0]. The hashes are shared.
Thank you to Troy Hunt
Thank you to Troy Hunt
The scenario I was looking at was..
User signs up with Site A with Password 1.
User signs up with Nest with Password 1.
Site A gets compromised.
Nest couldn't know if you'd used the same password on each site. The only way they could know is if they used the same hashing algo with the same salt or SHA-1 with no salt. Highly unlikely.
I suppose Nest could check the Pwned Passwords API every time they logged in, but I haven't seen anyone deploy that yet, IIRC all solutions I've seen check Pwned Passwords API when the set the password. Setting a password and checking a password are often different systems.