Hector Martin

Research that in general blacklists are worth annoyance when defending against online guessing attacks. 1 example: https://www.ece.cmu.edu/~lbauer/papers/2016/tissec2016-password-policies.pdf …

I'm not aware of research that looks at behavior as blacklists grow larger. Pls share if you do! Also studied blacklists have been ad-hoc

My gut is there's a point of diminishing rewards where large blacklists are annoying + the security is not worth it. But is it 1k, 1m, 100m?

The main usability frustration of blacklists is a user doesn't have knowledge of it before submitting their pw. Leads to (╯°□°）╯︵ ┻━┻

With small blacklists users might say, "Ok shouldn't have picked monkey". As BL grows, reject of user viewed "strong" pws cause frustration

1/2 the more I review pwd from @troyhunt list, the more I agree with this statement. Many look very strong from the avg Joe PoV. So may be…

2/2… use a short list client side at pwd creation, and use the full list server side few times a year for auditing pwd and warning users.

3/2 (I'm working in a University, as sysadmin/CISO, I'm already auditing pwd and educating my users, @troyhunt's list will help me here too)