3 ms·
Integrating HIBP checks in online platforms is nice, but what about the public (and admins) at large? Has HIBP been integrated in upstream for registration/logi
by moviuro 8y ago
Integrating HIBP checks in online platforms is nice, but what about the public (and admins) at large? Has HIBP been integrated in upstream for registration/login forms in "usual" software? I'm thinking about Nextcloud[0], Wordpress, GitLab, etc.
There should be no harm in doing it, and the admin would get a new switch "check the password with HIBP at login time (Y/n)". This could have a good impact - and it could be done from either client or server-side.
EDIT: after checking, it's already in Nextcloud: [0] https://github.com/nextcloud/password_policy/commit/fed9c37ff620cb74dc027a5a40b27313e26c5ba3 https://github.com/nextcloud/password_policy/commit/fed9c37f...
- ubernostrum 8y agoThere are libraries for doing this, but it's ultimately up to each site/service to implement. I maintain an add-on for Django that does this, for example, but I can't force people to go and use it, though I also maintain one of the more popular user-registration apps and I probably will find a way to enable it by default in there.
- Flimm 8y agoCould I have a link to your Django add-on?
- ubernostrum 8y agohttps://github.com/ubernostrum/pwned-passwords-django https://github.com/ubernostrum/pwned-passwords-django