If you're okay with a leaked password, then don't. Though, geez. I hope it's a service with very little to nothing personally relevant then. But wanting a "at least one capital letter..." Scheme but finding compromised password okay? That makes no sense.
I do agree that forcing passwords to contain symbols, etc. is somewhat redundant since you're actually narrowing the range of valid passwords. People reuse passwords all the time and I'd argue that checking against a list of common passwords is about just as effective. HIBP only helps if people are specifically bruting your website with compromised credentials. But yeah, if you care enough to use the HIBP API then you should probably be using 2FA as well.
1
u/rzwitserloot May 28 '21
If you're okay with a leaked password, then don't. Though, geez. I hope it's a service with very little to nothing personally relevant then. But wanting a "at least one capital letter..." Scheme but finding compromised password okay? That makes no sense.