Disallow WordPress and WooCommerce users using pwned passwords.

Tang Rufus

Itineris Limited

<p>Disallow WordPress and WooCommerce users using pwned passwords.</p>
<h3>Goal</h3>
<p>Spoiler Alert: <strong>User passwords never leave your server, not even in hashed form</strong>.</p>
<p>Although reusing passwords is solely users’ fault but when evil attackers brute forced users’ passwords, and stole all their personal information or spent users’ hard earn money through your site. <strong>Those lazy users blame you</strong>, the site owner/developer.</p>
<blockquote>
<p>When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example,…</p>
<ul>
<li>Passwords obtained from previous breach corpuses</li>
</ul>
<p>— <a href="https://pages.nist.gov/800-63-3/sp800-63b.html" rel="nofollow ugc">NIST Digital Identity Guidelines</a></p>
</blockquote>
<p>This plugin’s solely purpose is to <strong>disallow WordPress and WooCommerce users reusing passwords listed in <a href="https://haveibeenpwned.com/" rel="nofollow ugc">Have I Been Pwned</a> database</strong>.</p>
<h3>Usage</h3>
<p>Activate and forget.</p>
<p>This plugin intercepts when:</p>
<ul>
<li>creating new users on <code>/wp-admin/user-new.php</code></li>
<li>changing other users’ passwords on <code>/wp-admin/user-edit.php</code></li>
<li>changing your password on <code>/wp-admin/profile.php</code></li>
<li>new user registration on <code>/wp-login.php?action=rp</code></li>
</ul>
<p>Additional interceptions if WooCommerce is installed:</p>
<ul>
<li><a href="https://github.com/woocommerce/woocommerce/blob/master/includes/class-wc-form-handler.php" rel="nofollow ugc"><code>WC_Form_Handler::process_reset_password</code></a> on Home » My account » Lost password</li>
<li><a href="https://github.com/woocommerce/woocommerce/blob/master/includes/class-wc-form-handler.php" rel="nofollow ugc"><code>WC_Form_Handler::save_account_details</code></a> on Home » My account » Account details</li>
<li><a href="https://github.com/woocommerce/woocommerce/blob/master/includes/class-wc-form-handler.php" rel="nofollow ugc"><code>WC_Form_Handler::process_registration</code></a> on Home » My account</li>
<li><a href="https://github.com/woocommerce/woocommerce/blob/master/includes/class-wc-checkout.php" rel="nofollow ugc"><code>WC_Checkout::validate_checkout</code></a> on Home » Checkout</li>
</ul>
<h3>Explain It Like I’m Five</h3>
<ul>
<li><a href="https://www.troyhunt.com" rel="nofollow ugc">Troy Hunt</a>, a well-kown security expert, collected 6,493,641,194 (and counting) pwned passwords from previous security breaches</li>
<li>Pwned passwords stored as SHA-1 hashes on haveibeenpwned.com</li>
<li>Whenever WordPress / WooCommerce users attempt to change their passwords, this plugin hashes the user password</li>
<li>Take the first 5 characters from the hash</li>
<li>Ask haveibeenpwned.com for all pwned passwords with the same first 5 hash characters</li>
<li>Check how many times the user password appears on the have I been pwned database</li>
<li>Disallow the password change if it has been pwned</li>
</ul>
<p>Users aged older than five could learn more from:</p>
<ul>
<li><a href="https://haveibeenpwned.com/FAQs" rel="nofollow ugc">Have I Been Pwned’s FAQs</a></li>
<li><a href="https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/" rel="nofollow ugc">Why SHA-1 was chosen in the Pwned Passwords</a></li>
<li><a href="https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity" rel="nofollow ugc">I’ve [Troy Hunt] Just Launched “Pwned Passwords” V2 With Half a Billion Passwords for Download</a></li>
<li><a href="https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/" rel="nofollow ugc">Validating Leaked Passwords with k-Anonymity</a></li>
</ul>
<h3>For Developers</h3>
<p>Fork the plugin on <a href="https://github.com/ItinerisLtd/disallow-pwned-passwords" rel="nofollow ugc">GitHub</a>.</p>


Alternatives to Disallow Pwned Password

Top alternatives