Compromised (pwned) password check

In the InfoSec world, a pwned password is a password that has been exposed in data breaches (i.e., they are owned/pwned by hackers).

Using a pwned password significantly increases the chances of being the victim of a data breach. Pwned Check leverages Troy Hunt’s Pnwed Passwords API and automatically checks to see if a password that you’re using (or are thinking of using) has been pwned by hackers. If it has, you will be notified and can be proactive and choose something else to stay out of harm’s way. There are over half a billion passwords in the Pwned Passwords database.

In existing databases, Pwned check is not turned on automatically.

1. Go to Administration – System Settings – Password Validation.

2. In the Compromised (pwned) check option, choose Enabled from the list and click OK.

Remote Desktop Manager analyzes a password when you save an entry. A message is displayed when a password is found in the Pwned Passwords database. If you see this window, you should change your password immediately. Remember to change it in Remote Desktop Manager and the actual account.

Rest assured Remote Desktop Manager does NOT send your passwords to Pwned Passwords.

Here is how it works:

1. Pwned Password Check uses k-Anonymity.

2. Remote Desktop Manager only sends the first five characters of the SHA-1 password hast to the API.

3. The API sends back a list of every password hash that matches the first five characters of the hash. The API only sends back the second part of the hash.

4. Remote Desktop Manager compares the hashes on the list to the password hash for the password you want to use.

5. If there is a match, you receive a warning.

Remote Desktop Manager makes it easy to make strong passwords. The built-in Password generator creates secure passwords, following your specifications for password length and complexity. The password generator is available on every entry next to the password fields.