passprotect-js

https://developer.okta.com/blog/2018/06/11/how-to-prevent-yo... ("How to Prevent Your Users from Using Breached Passwords") | https://github.com/OktaSecurityLabs/passprotect-js is an example. Good behavior: > The new NIST recommendations mean that every time a user gives you a password, it’s your responsibility as a developer to check their password against a list of breached passwords and prevent the user from using a previously breached password. SP 800-63 specifically: https://pages.nist.gov/800-63-3/ | https://pages.nist.gov/800-63-4/

> I just wonder how one could create such a program that the users will have some guarantees that it will not leak stuff. You could do what Okta does with its PassProtect [1][2][3] browser extension and use the Have I Been Pwned API along with k-Anonymity [4][5][6]. PassProtect is a browser plugin that makes it easy for people to see in the moment whether or not their password was exposed in a breach. With a real time, as-you-type notification, PassProtect quickly alerts users of possible "riskier" passwords so they can take action immediately and without compromising privacy. By using k-anonymity, PassProtect ensures that your passwords are never seen, stored, or sent over the network during this checking process. We’ve also made it easy for developers to add this functionality directly into their app or website. By also surfacing relate

What it does is request a block of hashes from the server with a given 5-hex-digit prefix (ie, 20 bits). Then inside the browser it scans the block for the exact hash. Code at https://github.com/OktaSecurityLabs/passprotect-js/blob/mast...