Hector Martin

Czech post uses a minimal block list, with veeeery interesting choices... :-)https://twitter.com/spazef0rze/status/676700855681224704 …

Google et al. have 2FA, list of devices, locations. Like you said, other serverside features, which I like a lot, more than a block list.

It's very rare you would choose a secure AND leaked-from-someone-else pwd. Most blocklist hits will be either nonsecure or personal reuse.

The question is: is a block list the right way how to teach users about secure passwords/accounts? Maybe but you block 3 pws & they go away.

It's another tool in the chain. First something like zxcvbn to filter too simple pwds. Then a blocklist to prevent reuse.

With 300M block list you'll probably block anything not generated in a pw manager. I see why Top1(0)k might be a better option. It depends.

You're grossly overestimating the coverage of the 300M set. very_secure_password isn't in it. Try some passwords for yourself and see.

Random non obvious words from the dictionary aren't either. Seriously, it's not that bad. I'm tempted to add /use/share/dict/words to it.