Hector Martin

3/n Zxcvbn checks for mangled variations of its blacklists. Aka could easily be said it has over 300mil blacklist depending on configuration

4/n What I think makes Zxcvbn different from using Troy Hunt's list though is that it attempts to explain why a password was rejected aka UX

5/n Much longer way of saying the disagreement might not be on size of blacklist but the user's experience with the blacklist ;p

:) Put another way: teaching/UX about entire *classes* of bad password scales much better than a huge list of *only* leaked passwords

Use Chinese. Use Japanese. Use Cyrillic, Greek, Hebrew & Arabic. Use Unicode. Use it all. Choose life. Choose UX. Choose your own password.

If you think using Japanese or Chinese for passwords is reasonable, you clearly know nothing about how those two languages work.

Hint: the sequence of keypresses to type in those languages is unmemorizable and even nondeterministic, thus incompatible w/ password boxes.

Huh. I assumed that if a char is type-able, result would be independent of keystroke combos. Where can I read more about this?