How does Github knows my password is commonly used on other website?

user_9303902 0
Viewed 5206

Funny Fact, but don't know how it's happening. Just curious.

In the setting page of my Github account, showing "The password you provided is in a list of passwords commonly used on other websites. To increase your security, you must update your password...."

It seems to be normal but once I think deeper, I don't really get how Github knows my password is commonly used by other website!

I mean in the "other website's" perspective, Github supposingly does not know what set of password is used by its' client, then how Github know its' own client password is commonly used from other website?

enter image description here

github
1 Answers

As mentioned in this thread, since Q2 2020:

While the password you have at present may meet the listed requirements, the system also runs a check when you provide your password (during sign in, or sudo access).

The check compares a one-way hash of that password against our internal database of credentials known to be compromised by breaches of other websites or services.

The weak password message you received indicates that the password you have entered was used by someone (not necessarily yourself) on a website that was compromised, which means it’s on lists used by malicious actors in their automated takeover attempts.

So the comparison is about password hash, not the actual password.

The thread adds:

GitHub uses both open and private paid sources of breach data in order to protect customer accounts.
We don’t typically name our vendors and in some cases we are actually precluded from doing so by contract. The exception, of course, is where we share customer data with a vendor 5, and that isn’t the case here.

We have two different responses to any matching credentials:

  1. If there is a direct match - ie, your exact email and your password are present in a breach - then we force a password reset.
    You won’t be able to use your account again until you have reset your password.
    A direct match presents a high risk to the security of your GitHub account, and by extension, any GitHub repositories or organisations you have access to.

  2. If there is an indirect match - ie, your password has been in a breach, but not necessarily your exact email address - we then warn about a weak password, and give you a window of time in which to change it.
    This is a lower risk scenario, but still a risk.

We’re aware that we do take a conservative approach here, and that is constantly under review.
We understand that some people would prefer to be a little more relaxed about security themselves, but again, account takeovers create a substantial workload for us, and at present, an opt-out function is not an option.

VonC_63090
Related