Lesson 4.71: Breached passwords, passphrases and password managers
Billions of real passwords have leaked from breached websites, and attackers try them everywhere. A password that 'looks strong' to a rule (capital letter, number, symbol) can still be in every attacker's list. Modern guidance such as NIST SP 800-63B says: long passphrases, no forced periodic changes, and checking new passwords against breached lists. In the lab you check a password against a breached-password list the way Have I Been Pwned does, without sending the password anywhere, then build a passphrase and see why a password manager makes all of this practical.
16 min
You will learn to
- Explain credential stuffing and why reuse is dangerous
- Check a password against a breached list without revealing it (k-anonymity)
- Explain current password guidance (length, no forced rotation)
- Build a long passphrase
- Explain what a password manager solves
Key terms
- Credential stuffing
- Trying username/password pairs leaked from one site on many other sites.
- Breached-password list
- A collection of real passwords exposed in breaches, used by attackers and defenders.
- k-anonymity
- Sending only a hash prefix shared by many values, so the service can't tell which one is yours.
- Passphrase
- A long password made of several random words.
- Password manager
- An encrypted vault that generates, stores and fills a unique password for every site.
- NIST SP 800-63B
- US guidance on digital identity: favours length, breached-list checks, no forced periodic changes.
← Capstone: assessing and hardening the shop · All lessons · Third-party risk →