> Users cannot use any password matching a blacklist of the 10,000 most commonly used passwords.
I read the post but somehow missed that. Sincere apologies.
My question is, is 10k good enough? Wouldn't it be better to check against more? 50k?
Presumably more is always better, but there's a very long tail of passwords so the hit rate will drop off a cliff, and now you're storing 5x as much data for increasingly questionable benefit.
the problem is once you get to 10+ char passwords the common password list gets really tiny