CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
What is the purpose of checking user-supplied passwords against a 'have I been pwned' (HIBP) database during registration or password change?
- A.To reject passwords that have appeared in known data breaches, preventing users from choosing compromised credentials that are already in attacker wordlists - significantly reducing credential stuffing and brute-force attack success rates
- B.To verify the user has not previously registered on the platform
- C.To automatically generate a stronger password for the user
- D.To check whether the user's email address was breached along with the password
Why A is correct
NIST SP 800-63b recommends checking new passwords against lists of known-breached passwords. The HIBP API uses k-anonymity (first 5 chars of SHA-1 hash are sent) so the full password never leaves the client. If a password appears in the breach database, users are prompted to choose a different one. This prevents 'Welcome1' or 'password123' - which are in every wordlist - from being used.
Know someone studying for Web App Fundamentals? Send them this one.