Yesterday, the legendary Troy Hunt made his complete leaked password database freely accessible to everyone in the world. You can download it and use it offline too! Unfortunately, the database it anonymised, means you cant find the source of the password and its hashed (SHA1).
Who is Troy Hunt
Troy Hunt is an Australian web security expert. He is known for creating the data breach search service Have I Been Pwned?, as well as for authoring several popular security-related courses on Pluralsight.
Lets see what he has to say about the use case of this database:
Use Case 1: Registration
At the point of registration, the user-provided password can be checked against the Pwned Passwords list.
Use Case 2: Password Change
Password change is important as it obviously presents another opportunity for users to make good (or bad) decisions. But it's a little different to registration for a couple of reasons. One reason is that it presents an opportunity to do the following:
Use Case 3: Login
Many systems will already have large databases of users. Many of them have made poor password choices stretching all the way back to registration, an event that potentially occurred many years ago. Whilst that password remains in use, anyone using it faces a heightened risk of account takeover which means doing something like this makes a lot of sense:
Download it here:
https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/
Have I been pwned?:
https://haveibeenpwned.com