Show HN: Devise extension that checks passwords against PwnedPasswordsgithub.com2 points·by michaelbanfield·8 lat temu·0 comments
Show HN: Serverless CSP reporting server that streams reports to S3github.com3 points·by michaelbanfield·9 lat temu·0 comments
michaelbanfield·8 lat temu·discussI just tried 'passwordpassword' and it was there. You can download the whole dataset at the bottom of this pagehttps://haveibeenpwned.com/PasswordsIts a losing battle trying to add byzantine rules to prevent users doing things like using their normal password * 2, so its probably a reasonable check to add.
michaelbanfield·8 lat temu·discussAdding the the plug train :)I wrote a devise extension thats essentially a one liner to add this check on signup (and a small code block to add on signin)https://github.com/michaelbanfield/devise-pwned_passwordNowadays most of the logic is encapsulated in the pwned gemhttps://github.com/philnash/pwnedWhich is a good choice if you arent using devise.
https://haveibeenpwned.com/Passwords
Its a losing battle trying to add byzantine rules to prevent users doing things like using their normal password * 2, so its probably a reasonable check to add.