Hector Martin

I would advice against using such a massive block list, top 1K-10K is enough, & implement other serverside features instead. Better UX.

That interest me. You mean it is not good idea to ban setting any of public leaked passwords?

This is worthy of a paper, Twitter not sufficient. I imagine blocking 306 million pwds would cause massive customer loss & complaints.

Password Creation in the Presence of Blacklists, USEC '17, http://www.passwordresearch.com/papers/paper650.html … Didn't measure such a large blacklist though.

And based on the 99.2% of Hunt's hashes I've cracked so far, if you simply require 12 characters minimun, 80% of his list is unnecessary.

And by setting minlength=12 and saying so on screen, UX but would be far better than being told «you can’t use that pwd Dave. Try again.»

Except for all the people with 8-10 character passwords not in the blocklist which are perfectly adequate and would be rejected.

... which is why you would tell them the minimum pwd requirements up front, *before* they are asked to set a pwd. Which is good UX.