[k7sune]

How does LastPass implement their security challenge, where they rate your passwords and compare them to known mass password leak incidents? Does that require an upload of plaintext passwords to the server?

[andirk]

Oh like 1st interview question is: "What's your password?".

A few jobs ago I needed some IT help and the guy asked me that. I told him my very vulgar password loudly. Then went back to my desk and changed it.

[wizofaus]

Not sure why you would think that was necessary or at all likely. We have these things called hashes...

[8n4vidtmkvmk]

that doesn't explain anything. they shouldn't be uploading unsalted hashes either. and if it's salted, it won't match with any database

[wizofaus]

True, the best solution is to download the list of hashed "bad passwords" and check if the one entered matches against that.

[neevans]

if salted hash is leaked then it doesn't matter and does not need to be detected anyway.

[marklyon]

Doesn't it run zxcvbn to calculate the score on the logged-in client?