3 ms·

That's not even an excuse. There are solutions out there that mitigate the fact people reuse the same passwords.

• philpem 8y ago
  I'd love to see a more specific version of Troy Hunt's "have I been pwned" API which explicitly blocked user/password combinations which had been leaked. The catch is, you'd have to store the pairs together which then makes you a target, so in practice the best you can really do is what's on offer already -- check that the password hasn't been leaked (and maybe if the email address has a high HIBP leak count). That solution would seem to force people into password managers and random high-entropy passwords or passphrases...
• randerson 8y ago
  Example solutions that wouldn't result in a massive customer drop-off though? The average person isn't going to set up 2FA or remember a randomly generated password just for a food delivery website.