3 ms·
The company I work for (stytch.com, we provide an authentication API) tracks breached passwords and, depending upon config, will invalidate passwords that have
by cco 3y ago
The company I work for (stytch.com, we provide an authentication API) tracks breached passwords and, depending upon config, will invalidate passwords that have been leaked. Will be interesting to watch our logs over the coming weeks.
- choppaface 3y ago.. do you happen to have a service that lets users know if their password was in the breach?
- ShowalkKama 3y agohttps://haveibeenpwned.com https://haveibeenpwned.com
- cco 3y ago^yup, haveibeenpwned is the best public service to check this sort of thing. I don't think they've pulled it in yet.
- choppaface 3y agoyeah but do they have this breach yet? edit: the OP suggests there are some password lists that are known leaked but not in public leak docs. not sure if pwned is only public leaks?
- fbdab103 3y agoThis reminds me of [0] where they maintain composite lists of frequently used passwords. Also in the repo is probably my favorite pull request ever [1]. [0] https://github.com/danielmiessler/SecLists https://github.com/danielmiessler/SecLists [1] https://github.com/danielmiessler/SecLists/pull/155 https://github.com/danielmiessler/SecLists/pull/155