How do you prevent exposed or breached passwords from being used in your application?

Question

As per the NIST800-63 special publication, we are expected to prevent exposed passwords or breached passwords from being used in our applications.

Wonder if any one of us is making use of this and if yes, how?

Jim Zhou · Accepted Answer

A bit tedious for sure now that hashes.org is down, most of their solved passwords are available, according to their discord, at https://hash.lol which is really just a publicly available ipfs gateway to the files.

Jan Mazurek · Answer

I shall upvote to follow the subject

Vinh · Answer

You can make use of Haveibeenpawn database/api? https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange

Devanand Premkumar · Answer

@kureikain That looks good for sure. Are you aware of any others offering such services?

Devanand Premkumar · Answer

Yes, looks like they are down for a couple of days in a row.  Not sure what happened to that useful site of theirs.

If given a choice, would you look out for other such services?

How do you prevent exposed or breached passwords from being used in your application?

Replies