Password reuse can be considered a pandemic of security. The obvious way to fix this is to encourage people to use password managers, but (comparatively) few people actually do.
My idea is to have websites, once a user signs up or changes their password, to check all other accounts for the same password. If one is found, after a set delay of maybe a day or so, an email would be sent to the user who signed up or changed their password alerting them of this fact and recommending they change their password.
I can imagine an immediate problem with this, which is system resources. It's expensive to securely hash passwords, and hashing a single password for comparison with thousands, possibly millions of accounts would be taxing. Another possible issue is spam, but I believe this can be fixed quite easily with email verification.
Assuming proper password storage practices, and assuming system resources isn't an issue, are there any security concerns about doing this?
To reiterate:
- A user signs up or changes their password.
- The system checks if that password is used in any other account. During this time, the password is stored in memory. If the system experiences a failure during this time, the check is cancelled and it is assumed the password is unique.
- If it is reused, the user receives an email the next day simply saying their password is used elsewhere and recommending the user changes it.