Password reuse can be considered a pandemic of security. The obvious way to fix this is to encourage people to use password managers, but (comparatively) few people actually do.
My idea is to have websites, once a user signs up or changes their password, to check all other accounts for the same password. If one is found, after a set delay of maybe a day or so, an email would be sent to the user who signed up or changed their password alerting them of this fact and recommending they change their password.
I can imagine an immediate problem with this, which is system resources. It's expensive to securely hash passwords, and hashing a single password for comparison with thousands, possibly millions of accounts would be taxing. Another possible issue is spam, but I believe this can be fixed quite easily with email verification.
Assuming proper password storage practices, and assuming system resources isn't an issue, are there any security concerns about doing this?
- A user signs up or changes their password.
- The system checks if that password is used in any other account. During this time, the password is stored in memory. If the system experiences a failure during this time, the check is cancelled and it is assumed the password is unique.
- If it is reused, the user receives an email the next day simply saying their password is used elsewhere and recommending the user changes it.