I remember some password managers like Google's would give me a warning about passwords that have been compromised.
My question is this. How is Google or any company able to see that the password I have chosen matches one that has been compromised?
My first thought on this is that they must have gotten it from 1 of 2 places. Either they themselves would do what a hacker would do and download a bunch of files with bulk information they could try for like 10 million account combinations. They could get this from where it would be seen first aka the dark web, or they get the bulk passwords from the company that says its been hacked and releases whose information was compromised. I am not sure though and would like to invite other opinions on how they are able to legally obtain the hacked data. Assuming they have some sort of contract with the government that says I promise not to do anything bad with this information.
In general there must be some way to get like a permit to explore on the dark web in order to get information on the latest hacks. Seems like the quickest way to counteract hacks.
hunter2, the hashed version is
f3bbbd66a63d4bf1747940578ec3d0103530e21d. HIBP takes leaked passwords and stores the hashes. It can then claim that a password with the hash
f3bbbd...has been compromised, which can be checked by other applications.