Hector Martin

Maybe a soft-block of non-top10k would be okay then? You know the "somebody else is using your password" jokes might be useful eventually:-)

Does Google, Twitter, Facebook or your bank use any blacklists? Why/not?

They use lists for lowering pw score, not technically a block list, though. My bank uses SMS OTP with PIN, my other bank allowed login=pw.

Czech post uses a minimal block list, with veeeery interesting choices... :-)https://twitter.com/spazef0rze/status/676700855681224704 …

Google et al. have 2FA, list of devices, locations. Like you said, other serverside features, which I like a lot, more than a block list.

It's very rare you would choose a secure AND leaked-from-someone-else pwd. Most blocklist hits will be either nonsecure or personal reuse.

The question is: is a block list the right way how to teach users about secure passwords/accounts? Maybe but you block 3 pws & they go away.

It's another tool in the chain. First something like zxcvbn to filter too simple pwds. Then a blocklist to prevent reuse.