How does Okta handle the NIST requirement of checking user passwords against known breached passwords?

Loading

Skip to Navigation Skip to Main Content

Search

Search

Select Language

0D50Z00008KfTX3SANOkta Classic EngineAdministrationAnswered2025-07-27T09:00:12.000Z2018-09-05T17:24:28.000Z2020-12-10T11:49:16.000Z

uajg5 (uajg5) asked a question.

September 5, 2018 at 5:24 PM

How does Okta handle the NIST requirement of checking user passwords against known breached passwords?

NIST has a requirement to not allow passwords that have previously been breached. Is there a way to implement this into Okta?

```

When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to:

Passwords obtained from previous breach corpuses.

```

https://pages.nist.gov/800-63-3/sp800-63b.html

Top Rated Answers

vignesh.lakshminara1.5248408386703123E12 (Okta, Inc.)
8 years ago
Thank you for posting your question on the Okta Community. We have a feature to check the commonly used passwords which is an Early access feature and checks to ensure that passwords are not too weak based on a list of the most commonly used passwords. This needs to be enabled in your password policy in Okta. I would recommend you to open a case with Okta Support to have this feature enabled for your org. You can refer to our documentation for more information: https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm#Configur
Expand Post
Selected as Best

All Answers

vignesh.lakshminara1.5248408386703123E12 (Okta, Inc.)
8 years ago
Thank you for posting your question on the Okta Community. We have a feature to check the commonly used passwords which is an Early access feature and checks to ensure that passwords are not too weak based on a list of the most commonly used passwords. This needs to be enabled in your password policy in Okta. I would recommend you to open a case with Okta Support to have this feature enabled for your org. You can refer to our documentation for more information: https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm#Configur
Expand Post
Selected as Best
- 00ubx0ib1DYLPTJFIOK1.4334241508650737E12 (Customer)
  6 years ago
  Hey @vignesh.lakshminara1.5248408386703123E12 (Okta, Inc.) sorry to bomb this thread with hope of notifications being seen by someone to come back and respond here, but the question asked and the answer here are really not aligned and I'd like some specific comments on the state of password security and checking passwords against known breaches and custom dictionaries for example.
  
  Or do I have to start a new thread to get someone to look at this? Thanks!
  
  Expand Post
- amvov (amvov)
  6 years ago
  This does not answer the question.
  
  According to the documentation you linked, the Common password check tests against a "a list of the most commonly used passwords".
  I could find no documentation revealing the number of entries in Okta's common password list or the frequency that it is updated, but the list from haveibeenpwned.com has been updated about twice a year since 2017 and currently contains over a half billion passwords.
  
  While your solution technically complies with the minimum standard in the NIST guideline, @uajg5 (uajg5) specifically asked about "known breached" passwords, and it is disingenuous and misleading to imply that a static list of the most common passwords is equivalent to a biannually updated list of all known breached passwords.
  Expand Post
mike.davie1.5312945692819849E12 (Customer First Programs)
8 years ago
Hello Michael,

Thanks for posting your inquiry in Okta Community Portal.

If you receive a great answer to your question(s), please help readers find it by marking it the best answer. Hover over the answer and click "Best Answer."

Thank you,
Mike Davie
Okta Help Center
Expand Post
amvov (amvov)
7 years ago
Has there been any update to this feature? Testing against a list of commonly used passwords is certainly helpful, but I think the OP was referring to comparing user passwords against existing data breaches, per NIST guidelines, not just checking a list of commonly used passwords. This is a feature currently provided by competitors, such as Auth0's breached password detection.
Expand Post
00ubx0ib1DYLPTJFIOK1.4334241508650737E12 (Customer)
6 years ago
I would also like to bump this thread. It's disappointing to see that Okta appears to have ignored this for 2 years almost.

Being able to validate passwords against known compromised passwords is table stakes feature wise.

@vignesh.lakshminara1.5248408386703123E12 (Okta, Inc.) can you please respond to this with direct acknowledgement of @uajg5 (uajg5) 's request?

As @amvov (amvov) points out there are many others that support this, Lastpass is another example. In fact, if you have a password that gets compromised after you store it they will notify you, although you have to enable or run a security scan on your account to get that feedback.
Expand Post
DharamdeoN.46266 (Customer)
6 years ago
Bump - 17 days ago @00ubx0ib1DYLPTJFIOK1.4334241508650737E12 (Customer) flagged this as being ignored and it still has no updates. 😞
Expand Post
- 00ubx0ib1DYLPTJFIOK1.4334241508650737E12 (Customer)
  6 years ago
  I suspect they are ignoring it because @vignesh.lakshminara1.5248408386703123E12 (Okta, Inc.) 's answer was selected as 'Best' even though it's a non answer. It should say 'we don't do that yet, but we can do X'.
  
  Okta should seriously implement proper password security features aligned with current NIST guidelines.
  Expand Post
miqxq (miqxq)
6 years ago
Okta should seriously do better at monitoring these discussions. I mean actually have someone read and respond to them and stop with the annoying bot-like responses:

"Thanks for posting your inquiry in Okta Community Portal.

If you receive a great answer to your question(s), please help readers find it by marking it the best answer....."

Expand Post
9ct40 (9ct40)
5 years ago
I think you will find a better answer in this thread https://support.okta.com/help/s/question/0D51Y000069Oa5t/what-classifies-as-a-common-password?language=en_US
Expand Post

This question is closed.

Recommended content

Forum

Okta fails NIST requirements to properly check passwords against known breached passwords.

Forum

Breached passwords check

Forum

Breached Password Protection

Forum

Is there an API to check if password is strong or not?

Loading

How does Okta handle the NIST requirement of checking user passwords against known breached passwords?