Real-time Internet Authentication Weakness Inspection Service

最终用户经常选择质量较差的密码作为密码，并经常在多个应用程序中重复使用它们。这意味着一个系统对应用程序的危害可能会通过凭据填充攻击对其他应用程序产生连锁反应。从技术上讲，这可以通过双因素身份验证在一定程度上得到缓解，但应用程序提供商如果增加登录复杂性，就会面临用户流失的风险(尤其是在与公众打交道时)，因此不愿执行额外的身份验证步骤。该项目的目标是通过提供实时、高度安全的泄漏凭据检查协议和服务来化解潜在的凭据填充/密码重用攻击，该协议和服务将增强应用程序身份验证系统的安全性，而不需要为用户添加额外的验证步骤。

End users often choose poor quality secrets for their passwords, and frequently re-use them across multiple applications. This means that compromise of an application from one system can have knock on impact to other applications through credential stuffing attacks. Technically, this could be mitigated to some degree with two factor authentication, but application providers risk subscriber drop off (particularly when dealing with the public) if they add logon complexity, and are therefore reluctant to enforce additional authentication steps.This project will aim to defuse the potential for credential stuffing / password reuse attacks by delivering a real-time, highly secure leaked credential checking protocol and service which will enhance the security of application authentication systems without the need to add additional verification steps for the user.