Prevent users from using a compromised password

[François Marier]

Troy Hunt released a massive database of compromised passwords (hashed): https://haveibeenpwned.com/Passwords

They passwords can be assumed to be available in all of the password-cracking dictionaries and therefore should never be used since they are trivial to crack.

Libravatar should use this database to

1. prevent users from registering a new account with one of these passwords,
2. prevent users from changing their password to one of these passwords, and
3. warn users who log into the site using one of these passwords and urge them to change their password.

More guidance in Troy's blog post: https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/