That’s also exactly what this plugin is for.
I have mulled this over for a bit since writing this plugin, and I’ve come to agree with Jeff.
“breached” means that there was someone, somewhere that thought up that phrase that appeared on “a list”. Imagine if someone created a tool that:
- Made a list of strings public.
- Systematically generated and appended unique strings to the list.
Jeff’s argument is that this means that eventually, all strings will be “insecure” because they appear on some public list somewhere - and eventually, your “super secure” passphrase would also appear on this ever-expanding list.
The whole idea of passwords themselves are only leaning on a “statistical impossibility” of someone not being able to guess a password for your account. An attacker technically don’t need to know a password, they need to just make a realllly good guess. They can push this in their favor by loading what it means to make a “good guess”:
- If they have a breach, try the same password for the same account
- If they have a list of breaches, try the passwords that a lot of people use
We’ve already discussed how Discourse is good at item #2 above. I think what you’re trying to target is #1 but it is rather unnecessary and a usability nightmare to have something like this (assuming any password, not tied to the username, should not be used) in core… But if you want what you’re describing for your site, this is the plugin for you.