That doesn't work, because of hunter2 is in the PW database but hunter3 isn't, y... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		fjsolwmv on June 11, 2019 \| parent \| context \| favorite \| on: Project Svalbard: The Future of Have I Been Pwned That doesn't work, because of hunter2 is in the PW database but hunter3 isn't, your system will think hunter3 is secure even though it's not.

noisy_boy on June 11, 2019 [–]

I think it should be two step - checking against the list and if that passes, complexity check. Covers complex passwords that are known to have been in use/leaked and non-complex ones too.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact