A while ago, I was tipped off that it's a good idea to check if the password provided at registration is contained in any list of leaked passwords. I'm not in the information security field, but I really like to take aspects like this seriously, I always think about the issue of passwords. The website haveibeenpwned provides an API to do such a task, which is very nice.
I'm not sure if this would impact my application in a positive way, I think it would. However, I would like to hear from those of you who work with intrusion testing.
You might be asking yourself: why is he talking about intrusion testing if the idea is to prevent something when signing up? Well, the idea is that if the user is not able to use passwords that have already been leaked, then an attacker will have less chance in password guessing attacks, for example, in a dictionary attack. Of course, to deal with such attacks, it is not enough just to implement this mechanism mentioned in the question, I know it's not enough, but it would be one more mechanism that would make the application more reliable.
After performing a search, I found an interesting resource from the Okta Developer website.
Not too long ago, the National Institute of Standards and Technology (NIST) officially recommended that user-provided passwords be checked against existing data breaches.
The new NIST recommendations mean that every time a user gives you a password, it’s your responsibility as a developer to check their password against a list of breached passwords and prevent the user from using a previously breached password.
For instance, let’s say that your password, “fdsah35245!~!3”, was breached in the well-known Sony data breach back in 2014. Once those passwords were leaked, attackers would download the compromised passwords and use them to try to log into other user’s accounts.
So, as mentioned in the quotes, the idea seems to be good and efficient, however, maybe this generates usability problems, can it happen that the user does not feel comfortable with such a mechanism? Anyway, this seems like a good idea, implementing this mechanism could make the application more secure, but maybe I'm wrong?
Let me know what you think about it, my goal is to become a better developer, I don't like the idea of having to create vulnerable apps.