Hector Martin

Goal is to resist *targeted* per-user online attack before other throttling kicks in. https://github.com/dropbox/zxcvbn  is a solid starter pack

I agree with @TychoTithonus. UX is the most important, and thanks for recommending zxcvbn as a blacklist since that highlights the UX issue

1/n Zxcvbn has multiple blacklists, which ones it uses is complicated since there's rankings and thresholds....

2/n Zxcvbn default blacklists: 100k english words from wikipidia, ~100k names (first + last), 47k common passwords, 39k words from tv & film

3/n Zxcvbn checks for mangled variations of its blacklists. Aka could easily be said it has over 300mil blacklist depending on configuration

4/n What I think makes Zxcvbn different from using Troy Hunt's list though is that it attempts to explain why a password was rejected aka UX

5/n Much longer way of saying the disagreement might not be on size of blacklist but the user's experience with the blacklist ;p

:) Put another way: teaching/UX about entire *classes* of bad password scales much better than a huge list of *only* leaked passwords