HaveIBeenPwned

Content Type: Module
Categories: Authentication

Overview

A module that allows you to check if accounts have been breached by reaching out to the Have I Been Pwned API from Troy Hunt. Besides checking for breached accounts this module also offers a check if passwords occur in previous breaches. Use case 1: you want to check if the account in your app are previously have been breached so you can enforce a password reset if necessary. Use case 2: you want to make sure users don't use a previously breached password which is in line with the NIST password guidelines.

Documentation

Description

Module that makes use of the Have I Been Pwned API service made by Troy Hunt

With this module it is easy to find easily breached accounts and on what platform they were breached based on the data that is in the Have I Been Pwned database. All cracked passwords from all of the these breaches have been put in a gigantic (hashed) database itself and can be queried as well which will return the number of occurrences.  

Typical usage scenario

You want to check whether accounts in your app have been breached to enforce better security or a password reset
You want to make sure your users aren’t using passwords that have been found in breaches before.

Features and limitations

  • The breached account API is rate limited at one request per 1500ms, there is an automatic retry mechanism with a delay based on the response the API gives back. 
  • There is no support for the Paste breaches, Single breached sites, Data classes, or all Breaches.
  • For more information about the API use go to https://haveibeenpwned.com/API/v3 or read one of Troy’s latest blog posts about the security misconceptions of Pwned Passwords

Dependencies

Installation

  • Breaches:
    • Use the SUB_Account_CheckForBreaches microflow
    • Set Error Handling on the mircoflow to handle errors from the API gracefully
  • Pwned Passwords
    • Use PasswordSettings snippet to set your preferred password policy
    • Use the PasswordNotBreached rule to check if the Password is inline with the set password policy. 

Configuration

  • Breaches:
    • Fill the API key
    • Decide if you want to use Full or Truncated responses
    • Add the name of your app as the User Agent
  • Pwned Password
    • Make sure you set the StrictnessPolicy in the Setting

Releases

Version: 1.2.0
Framework Version: 10.3.1
Release Notes: Upgraded to Mendix 10.3.1
Version: 1.1.0
Framework Version: 9.18.7
Release Notes: Upgraded version to Mendix 9.18.7
Version: 1.0.1
Framework Version: 8.12.6
Release Notes: Consistent naming of modules and microflows. Also possible to search for phone breaches.
Version: 1.0.0
Framework Version: 8.12.6
Release Notes: Initial release of module to connect to the Have I Been Pwnd API's