The Data Center (ZDV) has been carrying out an additional security check with the database https://haveibeenpwned.com/ for every new password and password change since January. This collects the hashes of the passwords* from password databases that are circulating on the Internet and checks whether the selected password was published in the event of a previous data leak. If this is the case, users will receive a message on the JGU account page that the password entered was part of a data leak and must not be used.
If the password is changed under Windows using the key combination CTRL + Alt + Del or in such a case, Ctrl + Alt + Del "Change password" appears that the password does not meet the complexity rules. A more specific message cannot be displayed as the ZDV has no way of adapting it.
To ensure that the hashes of the passwords* are not passed to a third party or website, the ZDV copied the entire database directly from the provider and runs it on its own server.
Further information on creating secure passwords: https://www.en-zdv.uni-mainz.de/account-change-of-password/
*Technical background
The password itself (the plain text) is not checked. Only the user should know this. Instead, the so-called hashes of the passwords are examined. These are character strings of a certain length that are determined with the help of mathematical processes. This process can be described as a type of coding and takes place relatively quickly in the direction of password -> hash. However, the inversion (hash -> password), i.e. calculating back a hash, is almost impossible due to the complexity and the enormous computing effort.
More news from the Data Center → may be found here.