3 ms·

How easy/legal is it to obtain breached passwords for legitimate purposes? If I see a user try to sign up with an email + password in the breach list, I'd like

by bagels 3y ago

How easy/legal is it to obtain breached passwords for legitimate purposes? If I see a user try to sign up with an email + password in the breach list, I'd like to tell them to pick a different password, for instance.

jtbayly 3y ago
Check out the https://haveibeenpwned.com https://haveibeenpwned.com API.
wepple 3y ago
There is haveibeenpwned as mentioned, but you could also just use a password list of common passwords and ban those completely. It would stop more attacks, like standard password guessing attacks.