Better passwords in Ruby applications with the Pwned Passwords API

At Twilio we're fans of using a second factor to protect user accounts, but that doesn't mean we've forgotten the first factor. Encouraging users to pick strong passwords is still the first line of defence for their accounts.After spending years collecting lists of passwords from publicly available data breaches at HaveIBeenPwned, Troy Hunt has made available an API to check whether a password has been used before. This post will show you how to encourage your users to use stronger passwords by checking against the pwned passwords API.