What Is Password Spraying, How It Works and How to Prevent It
1–3 of 3 posts
Re: What Is Password Spraying, How It Works and How to Prevent It
#2I think that this point in time if you're building a password authentication system, you definitely should check user passwords against Pwned Passwords[0] when creating the account and maybe even when they log in.
The better way of course is to outsource the authentication to Google, Microsoft, Okta, or someone else and let them deal with the bots. :)
Re: What Is Password Spraying, How It Works and How to Prevent It
#3I think that this point in time if you're building a password authentication system, you definitely should check user passwords against Pwned Passwords[0] when creating the account and maybe even when they log in. The better way of course is to outsource the authentication to Google, Microsoft, Okta, or someone else and let them deal with the bots. :) [0]: https://haveibeenpwned.com/API/v2#PwnedPasswords
Totally agree on the compromised credential check, hence it‘s also part of my general password policy recommendations [0].
I also agree that IdPs and SSO is commodity nowadays (to speak in Wardley-terms). However, some orgs still have vastly heterogeneous authentication systems. In these situations it might be financially beneficial first do unify and then switch to an off-the-shelf service provider later. OIDC makes it possible.
[0]: https://www.jbspeakr.cc/password-strength-policy-guide/#pass...