Please change your password?

[gregw]

Select Topic Area

Question

Body

I've just received an email from Github asking that I change my password because I am "accessing GitHub with a password that is in a list of passwords commonly used on other websites"?

I'm a bit dubious about this, as my password is not a common word and is generated per site.

Thus this email raises a couple of questions:

• Are github storing my password in the clear so they can do such comparisons? Or are they just hashing a list of common passwords and are reporting a hash clash?
• Are github trying lists of passwords obtained that have been exposed? My passwords are normally unique per site, but there is some chance of a duplicate, so I'm worried that perhaps one of my passwords has been compromised from another system and then tried by githubs security process?

I have 2FA turned on, so I'm not in a huge hurry. I'll definitely change my password, but I'd like to know a bit more about how they are generating such warnings as it will affect how I change my password system and on what sites I change it.

[linuxlawson]

A little info on why this might be happening: https://stackoverflow.com/questions/68781632/how-does-github-knows-my-password-is-commonly-used-on-other-website
and what it means.

[gregw]

Thanks. For those looking here the short answer is: github is comparing hashes of the password against hashes of passwords from lists of passwords obtained from both open and private paid sources of breach data.
So getting a message like this might mean that your password has been compromised on another site... or that a password with the same hash has been compromised on another site... which is probably just as bad as only hashes are used to check passwords. Also hints that perhaps your password is not long enough.

[snarkywit]

WTH do I change my password

[SWR-DMaster]

The password is there to protect my account containing my information. Leaving my car doors unlocked isn't smart but shouldn't be illegal or be mandatory to lock them.

It's like a third party hears you lost one of your house keys and then decides to force you to immediately rekey your entire house before you are allowed to go back into your house. Completely unreasonable.

Github, don't force me to change my password; let me know the issue exists and ask me to change it all you like, though.