2 ms·

https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords > This password wasn't found in any of the Pwned Passwords loaded into Have I Been Pw

https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords > This password wasn't found in any of the Pwned Passwords loaded into Have I Been Pwned. That doesn't necessarily mean it's a good password, merely that it's not indexed on this site. But I doubt it's a common practice to do this kind of check.

g-b-r 3y ago
Yeah it's sure not common yet but in a 2021 post Troy Hunt says it was already thousands: > literally thousands of other services doing everything from providing their own password checker through to checking their customers' passwords on every registration, login or password change to see if it's previously been breached (https://www.troyhunt.com/open-source-pwned-passwords-with-fbi-feed-and-225m-new-nca-passwords-is-now-live https://www.troyhunt.com/open-source-pwned-passwords-with-fb...)
- drdaeman 3y ago
  Right, but thousands is a minuscule number - there are myriads of services out there. While it would've been nice if 23andMe would've used a service like this, can't exactly blame them if they didn't - it's not like this is some well-established industry standard, but more like an extra effort by extra security-conscious companies.
  - g-b-r 3y ago
    Yes true What I'd blame 23andMe for, is having encouraged so much all that sharing of sensitive data with other accounts, without providing additional safeguards to access such data.
kazinator 3y ago
I don't think it's a good idea to depend on yet another third party domain in this way. The check has low value. HaveIBeenPwned only provides value when it positively informs about a pwned password, otherwise it says nothing useful. If you're already rejecting weak passwords using some heuristics, then the remaining passwords are unlikely to show up on that site, because, strong passwords are unlikely to be pwned, even if reused and subject to a breach.

g-b-r 3y ago

Yeah it's sure not common yet but in a 2021 post Troy Hunt says it was already thousands: > literally thousands of other services doing everything from providing their own password checker through to checking their customers' passwords on every registration, login or password change to see if it's previously been breached (https://www.troyhunt.com/open-source-pwned-passwords-with-fbi-feed-and-225m-new-nca-passwords-is-now-live https://www.troyhunt.com/open-source-pwned-passwords-with-fb...)

drdaeman 3y ago
Right, but thousands is a minuscule number - there are myriads of services out there. While it would've been nice if 23andMe would've used a service like this, can't exactly blame them if they didn't - it's not like this is some well-established industry standard, but more like an extra effort by extra security-conscious companies.
- g-b-r 3y ago
  Yes true What I'd blame 23andMe for, is having encouraged so much all that sharing of sensitive data with other accounts, without providing additional safeguards to access such data.

kazinator 3y ago

I don't think it's a good idea to depend on yet another third party domain in this way. The check has low value. HaveIBeenPwned only provides value when it positively informs about a pwned password, otherwise it says nothing useful. If you're already rejecting weak passwords using some heuristics, then the remaining passwords are unlikely to show up on that site, because, strong passwords are unlikely to be pwned, even if reused and subject to a breach.