2 ms·
It seems like an API to check compromised account / password combinations against a database of breached accounts could be useful. Websites could check users a
by scoot 12y ago
It seems like an API to check compromised account / password combinations against a database of breached accounts could be useful.
Websites could check users aren't reusing a compromised password either at account creation, or as a one-time check as existing user log in.
- scoot 12y agoIf you disagree, please reply with why. Save the downvotes for spam, trolls, jokes, memes and genuinely off-topic comments. The concept of securely checking the hash of a chosen password against a database of known compromised credentials hosted by a trusted 3rd seems like a reasonable addition layer of security to me. I'd love to hear counter-arguments.