[whyleyc]

Thanks for posting this - I hadn't realised they were already doing it. I'm not sure how else they could be combatting password reuse attacks, short of forcing every user to reset their password.

It sounds like their engineering time might be better spent on fraud detection algorithms.