### Author:  [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [2018年六月17日 23:10 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/1 "2018-06-17T23:10:34Z")
# [Discourse Pwned Passwords Validator](https://github.com/featheredtoast/discourse-pwned-passwords)
Adds a password validator that calls to Troy Hunt’s [Pwned Passwords API](https://www.troyhunt.com/i-wanna-go-fast-why-searching-through-500m-pwned-passwords-is-so-quick/).
How do you use it? [Install it](https://meta.discourse.org/t/install-a-plugin/19157). And… that’s it! Password changes will be blocked if a password match is found via the API.
If a user tries changing a password to one that has been found, the following message will appear:
Inspiration from: [Upgrading common password prevention - Pwned Passwords v2](https://meta.discourse.org/t/upgrading-common-password-prevention-pwned-passwords-v2/81922)
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [2018年六月18日 00:00 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/2 "2018-06-18T00:00:32Z")
How would you compare this to the Core list of 2344 10 char common passwords,
>
Apples to Oranges, 1 to 10, other?
500 million passwords?!
---
### Author:  [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [2018年六月18日 00:26 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/3 "2018-06-18T00:26:43Z")
500 million password, yes 😉
The API is backed by a ton of breached password dumps, which makes in infeasible to ship with core. It’s a plugin here because it depends on an external API. The advantages here are that as more breaches come in and are updated for the [Have I Been Pwned](https://haveibeenpwned.com/) service, this API will update accordingly. Downsides are, 3rd party services can change/go away, which is why this falls into plugin territory.
Please also note that this hasn’t been graced with **official** status yet, I wrote it this over the weekend because it seemed like pretty low hanging fruit and I wanted to take a crack at it.
---
### Author:  [@TheBestPessimist](https://meta.discourse.org/u/TheBestPessimist)
#### Post date: [2018年六月18日 05:16 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/4 "2018-06-18T05:16:21Z")
Are you taking into account this ranking: [Troy Hunt: I've Just Launched "Pwned Passwords" V2 With Half a Billion Passwords for Download](https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#eachpasswordnowhasacountnexttoit) ?
Maybe the [number of hits] counter could be a changeable setting with a tooltip taking the admin who’s editing it to above mentioned link?
I think this could be more useful than disallowing the use of passwords which were only counted 10 times for example (10 times out of 5kkk).
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年六月18日 06:32 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/5 "2018-06-18T06:32:00Z")
Be aware that once you move to 10 character and greater passwords, the value of the external lists is .. kinda debatable, because the number of samples is so many orders of magnitude less. Here’s an example, using [the most common 1 million of 10 million leaked passwords](https://github.com/danielmiessler/SecLists/tree/master/Passwords):
Based on this data – 883,203 out of the 1 million most common passwords are under 10 characters. That’s 88% of the dataset.
Extrapolating this to 500 million, that means you could discard all but 60 million for the purposes of Discourse, because it’s impossible to have a password under 10 chars. It also ignores sorting, because you probably only want to block passwords that are actually common (repeated).
---
### Author:  [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [2018年六月18日 07:05 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/6 "2018-06-18T07:05:44Z")
> [@TheBestPessimist](#):
>
> Maybe the [number of hits] counter could be a changeable setting with a tooltip taking the admin who’s editing it to above mentioned link?
Probably not a bad idea. I saw the count, but was not aware of the associated blog, and figured it could do _something_ with the counts, but wasn’t sure what during this round. Thanks for the link.
> [@codinghorror](#):
>
> the value of the external lists is … kinda debatable
Fair point. The core product does a pretty Damn Good Job™ already at password management, so it’s definitely not a necessity.
I built this because HIBP’s cache of password breaches has been an excellent source of checking for risk - It’s got a dead easy API, so it seemed like a simple additional option to give the more tinfoiled types.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年六月18日 07:20 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/7 "2018-06-18T07:20:04Z")
The larger point is that if you filter to the 60 million (out of 500 million) passwords that are 10 characters or more, and then ordered by frequency to further reduce it to the top million, that’d be pretty easy to ship with Discourse – no external API dependency or plugin required.
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [2018年六月18日 07:21 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/8 "2018-06-18T07:21:35Z")
> [@Mittineague](#):
>
> 050605rostik
Damn! You got me! Guilty as charged … 🤔😆
---
### Author:  [@TheBestPessimist](https://meta.discourse.org/u/TheBestPessimist)
#### Post date: [2018年六月18日 07:21 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/9 "2018-06-18T07:21:50Z")
> [@codinghorror](#):
>
> no external API dependency or plugin required.
May i suggest the plugin could build these passwords on rebuild? Would this take a lot of time? (in this case it means that discourse ❤ always has the latest passwords.
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [2018年六月18日 08:14 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/10 "2018-06-18T08:14:17Z")
Unless I missed it, the passwords are SHA1 hashed and there is a “number of times” value but no “character count” value. The “fast search” way (“range”) matches hashes of the first 5 characters to reduce the number searched against the hash of the full password.
So I’m not seeing an easy way to skip passwords that are less than 10 characters, but it looks like the low frequency matches might be able to be eliminated.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年六月18日 09:03 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/11 "2018-06-18T09:03:47Z")
Without character count, we’re hosed, since that reduces the search space by 88%.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [2018年六月18日 09:43 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/12 "2018-06-18T09:43:13Z")
> is a known password on Pwned Passwords
Just a minor comment: this is cryptic information for [certain users](https://meta.discourse.org/t/difficult-user-types/90013). Perhaps “Pwned Passwords” could have a link to the site? Or if html isn’t rendered in those messages, it could be replaced with the URL?
---
### Author:  [@jtbayly](https://meta.discourse.org/u/jtbayly)
#### Post date: [2018年六月18日 12:42 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/13 "2018-06-18T12:42:42Z")
The number of times a password has been hacked is irrelevant as far as I can tell. If my account has been hacked, then you want me to be prevented from using that same password again, especially with the same email.
Most people
1. Reuse passwords
2. Don’t know whether their “standard” login has ever been hacked somewhere
Therefore it makes sense to disallow passwords that have “only” been compromised once, doesn’t it? And the more unique (long) the password, the more this would hold true, in my thinking.
---
### Author:  [@TheBestPessimist](https://meta.discourse.org/u/TheBestPessimist)
#### Post date: [2018年六月18日 13:06 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/14 "2018-06-18T13:06:07Z")
> [@jtbayly](#):
>
> it makes sense to disallow passwords that have “only” been compromised once,
I disagree:
For a password which has only be hacked 3 times (for example) i believe there’s a rather big chance that _different_ people are using that pass, that it is for the same person to reuse it. Why? because it’s an _unused_ password.
100% secure passwords would really deter people from using your forum, just because you don’t accept their password, even though it is one made of 16 characters.
---
### Author:  [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [2018年六月18日 15:49 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/15 "2018-06-18T15:49:54Z")
I’ve added the threshold. It defaults to banning the password if it appears at all, which takes care of both concerns.
> [@jtbayly](#):
>
> The number of times a password has been hacked is irrelevant
Troy seems to have added the count in v2 as feedback:
> Now on the one hand, you could argue that once a password has appeared breached even just once, it’s unfit for future use. It’ll go into password dictionaries, be tested against the username it was next to and forever more be a weak choice regardless of where it appears in the future. However, I got a lot of feedback from V1 along the lines of “simply blocking 320M passwords is a usability nightmare”. Blocking half a billion, even more so.
It still defaults to the functionality you describe, but admins can now tune to their liking.
> [@tophee](#):
>
> this is cryptic
Updated to read “has appeared previously in a data breach. Please use a more secure password.” which should address this.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年六月18日 23:14 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/16 "2018-06-18T23:14:35Z")
> [@featheredtoast](#):
>
> However, I got a lot of feedback from V1 along the lines of “simply blocking 320M passwords is a usability nightmare”. Blocking half a billion, even more so.
I’m not really a fan of Troy. I don’t think he has the right concepts at work here, and that’s another example of what I mean. Disallowing people from seeing the length of the passwords is an absolute deal breaker, since length = security.
---
### Author:  [@jtbayly](https://meta.discourse.org/u/jtbayly)
#### Post date: [2018年六月18日 23:16 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/17 "2018-06-18T23:16:22Z")
Possibly so, but as I said, the longer the password, the more likely that it is only used by one person and that that person is compromised but doesn’t know it.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年六月18日 23:17 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/18 "2018-06-18T23:17:16Z")
> [@jtbayly](#):
>
> the longer the password, the more likely that it is only used by one person and that that person is compromised but doesn’t know it.
Not true, if the password is in fact unique and not reused across different sites. Burned on one site doesn’t necessarily mean burned on all sites.
Having multiple hits on the same password absolutely is, though.
---
### Author:  [@jtbayly](https://meta.discourse.org/u/jtbayly)
#### Post date: [2018年六月18日 23:18 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/19 "2018-06-18T23:18:59Z")
Just because a password is long doesn’t mean that it was created by a password manager for a single site.
The very fact that it is being entered on a Discourse site proves that it isn’t in use on only one site.
Edited to add: I’m not sure what the solution is, I’m just saying that there’s a pretty good argument for both ends of the length spectrum possibly containing passwords that should be disallowed. Whether it’s that case in reality, I don’t know, and even if it is, the number might be so small that it’s safe to just ignore it.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年六月18日 23:25 UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/20 "2018-06-18T23:25:11Z")
None of what you said matters; it’s the combination of username/email and password that makes it secure. The fact that a password appears in a list doesn’t make it inherently insecure.
Here’s what does, though: **knowing that {x} unique users all selected that password, above a statistical threshold of interest.**
Imagine a world where every password was invalidated for every human, the minute any other human, anywhere, chose that password. That’s what Troy was building toward, and it’s.. stupid.
[下一頁](https://meta.discourse.org/t/pwned-passwords-validator/90074.md?page=2)