Detecting compromised passwords
Yes, dear hearts, the bad guys do have extensive dictionaries of passwords that either are commonly used or have been compromised. One of the most effective ways of brute-forcing passwords is to use these dictionaries to perform a dictionary attack. This is when the password-cracking tool reads passwords from a specified dictionary and tries each one until either the list has been exhausted or the attack is successful. So, how do you know if your password is on one of those lists? Easy. Just use one of the online services that will check your password for you. One popular site is Have I Been Pwned?, which you can see here:
Figure 3.4 -- The Have I Been Pwned site
You can get to Have I Been Pwned? here:
All you really have to do is to type in your password, and the service will show if it’s on any lists of compromised passwords. But think about it. Do you really want to send your production...
