That's silly - if the db check times out after a second or two, fire off the 2nd factor and move on. Or do it the way google does and do the whole login flow lo

That's silly - if the db check times out after a second or two, fire off the 2nd factor and move on. Or do it the way google does and do the whole login flow locally, and fire off a db check in the background - if it comes back as a leaked pw, notify the user or mark a "necessary password change" for the next login. As for slower - I'm sure you believe that it's a big huge difference, but really it's a trade-off like all engineering decisions, and "much longer amount of time" isn't really useful input when discussing trade-offs. What's the actual time add? What is the time without using the check? Whats the overall time taken on the login flow? How sensitive is the data you're protecting? etc.