Reject passwords for having appeared in a previous breach

[ubalklen]

Maybe randomly, reject passwords for having appeared in a previous breach.

[troyhunt]

That's doable, any PRs implementing this by querying Pwned Passwords are welcome. Suggest making it quite early in the workflow, once the really screwy criteria appears then any password that meets that is highly unlikely to have been previously breached anyway.

[Saiv46]

I think instead there should be check for consecutive numbers or letters on "low" infuration level (since most breached passwords are 12345*, abcd*, etc)

[toby3d]

Alternative: create your own password breach consisting of all passwords which spammers try to enter. And regretfully report that the password entered by the spammer has already been used before or even by someone else, so, i'ts dangerous to use already leaked passwords.

As a result: an interesting database of passwords generated by spammers for future analysis.