madaidans-insecurities.github.io VS pam_pwnd

Recommend reading the Linux sections on https://madaidans-insecurities.github.io/

That's somewhat telling and can be used to "track" you, consider reading on non-Reddit privsec learning resources like Privacy Guides itself which you already know, PrivSec.Dev, madaidan's Insecurities and the like.

Considering the offer is legitimate (something I won't comment on), you shouldn't do most of these things, in my opinion. Don't mess with what'll be other people's phones. Sell them Pixels pre-installed with GrapheneOS and print papers with Auditor attestation instructions and maybe a few QR codes directing them to relevant documentation and privsec learning resources, such as the GrapheneOS documentation first and foremost, Privacy Guides, madaidan's Insecurities, PrivSec.dev, Seirdy's Home, Wonderfall's Lab, etc...

i never used it myself. only learned about it from security experts like madaidan or hardening guides like this one.

For some excellent advice on security and privacy based on thoroughly researched technical concerns rather than speculation or blind trust in your corporation of choice, see here: https://madaidans-insecurities.github.io/

> If the user has a super secure password shared with a different, compromised service, libcrack will not detect that.

There's a module[0] for that (TM).

> Expiry results in passwords like: (prefix)Dec2020, (prefix)5

libcrack can enforce similarity and rotation checks too [1].

> or cycling the last 2/3 entries.

There's also another module[2] just for that.

[0]: https://github.com/skx/pam_pwnd