well, let's say I run idiotService, and you login with a nice strong randomly generated passphrase, but since I'm idiotService, I just store it plaintext and ch

well, let's say I run idiotService, and you login with a nice strong randomly generated passphrase, but since I'm idiotService, I just store it plaintext and check against it.. to make matters worse, some bad guy steals my password list, but I'm such an idiot I didn't even notice... Troy hunt, in his ever-long quest of getting copies of these breaches, eventually gets a copy of all of my passwords and adds it to his database, and now suddenly, you the user get a warning, uhh.. this password is in the pwned-passwords DB... and now you know idiotService really is an idiot.