Password reset

[CashDiver]

Select Topic Area

Question

Body

I used the GitHub password on a few more services for a long time and now it was forced to reset because it is in "a list of passwords commonly used on other websiteslist". How did GitHub know? What does it mean?

[KentSpendy]

GitHub checks passwords against known compromised password databases to protect accounts. GitHub forces a password reset when it detects that your password appears in public breach databases, meaning it has been exposed somewhere on the internet even if not from GitHub itself. They do this by securely hashing your password and comparing it against large compromised password lists, without ever seeing your actual password in plain text.

[wang900115]

@CashDiver Hi. when you log in or set a password, GitHub securely hashes the password and checks it against public databases of known leaked passwords (for example, HaveIBeenPwned). GitHub will force you to reset it to protect your account from credential-stuffing attacks.

[CashDiver]

It's a good news although they don't make me happy. I understand, thanks a lot.

[Beshoy-R]

Hello @CashDiver
GitHub didn’t check what passwords you use on other services. When you create or update a password, GitHub compares it against known lists of leaked or commonly used passwords from public breach databases. If your old password appears there, GitHub marks it as unsafe and requires a reset to protect your account.

This simply means your password was exposed somewhere in the past and is no longer secure.

Please mark the discussion as solved✅.

[CashDiver]

It's a good news although they don't make me happy. I understand, thanks a lot.

[Owensitoow]

GitHub utiliza un sistema de verificación proactiva para proteger tu cuenta.

Cuando estableces o modificas tu contraseña, GitHub aplica un proceso de seguridad que compara una versión cifrada (hash) de tu contraseña con bases de datos globales de credenciales comprometidas. Estas bases de datos recopilan información de filtraciones ocurridas en diversos servicios a lo largo del tiempo.

¿Cómo funciona exactamente?

Tu contraseña se convierte en un hash seguro antes de cualquier verificación

Este hash se coteja con listas de contraseñas expuestas en incidentes de seguridad

Si se detecta coincidencia, GitHub solicita el cambio por prevención

Lo importante:
GitHub nunca conoce en qué otros servicios utilizaste esa contraseña, ni accede a tus credenciales en texto plano. Simplemente identifica que esa contraseña específica forma parte de un lote de datos que circula públicamente debido a filtraciones anteriores.

Esta medida de seguridad, aunque pueda resultar inconveniente, es una protección efectiva contra intentos de acceso no autorizado que utilizan contraseñas conocidas.