Hector Martin

The question is: is a block list the right way how to teach users about secure passwords/accounts? Maybe but you block 3 pws & they go away.

It's another tool in the chain. First something like zxcvbn to filter too simple pwds. Then a blocklist to prevent reuse.

With 300M block list you'll probably block anything not generated in a pw manager. I see why Top1(0)k might be a better option. It depends.

You're grossly overestimating the coverage of the 300M set. very_secure_password isn't in it. Try some passwords for yourself and see.

Random non obvious words from the dictionary aren't either. Seriously, it's not that bad. I'm tempted to add /use/share/dict/words to it.

Great :-) Checked some passwords cracked w/ http://crackstation.net  dictionary: exoddus Tbvfs1 9plams P1ll3d Neznašov Just the 1st is there.

If I were in the "stupid password policies" camp my password rule wouldn't be "anything 6 chars or more goes".