Hector Martin

2/n Zxcvbn default blacklists: 100k english words from wikipidia, ~100k names (first + last), 47k common passwords, 39k words from tv & film

3/n Zxcvbn checks for mangled variations of its blacklists. Aka could easily be said it has over 300mil blacklist depending on configuration

4/n What I think makes Zxcvbn different from using Troy Hunt's list though is that it attempts to explain why a password was rejected aka UX

5/n Much longer way of saying the disagreement might not be on size of blacklist but the user's experience with the blacklist ;p

6/n Or I guess it could be interpreted that Zxcvbn is overkill for most online password guessing threats ;p

Depends on sophistication of the defender. A low-and-slow bruteforce from a million-node botnet may not be detected by some mid-tier orgs

Especially when each IP does only one or two probes.

Akamai published some good data from a real attack like this earlier this year: https://www.reddit.com/r/Passwords/comments/5qv5pw/blocking_online_password_guessing_attacks_when/dd2bgo3/ …