I read the post but somehow missed that. Sincere apologies.
My question is, is 10k good enough? Wouldn't it be better to check against more? 50k?
Presumably more is always better, but there's a very long tail of passwords so the hit rate will drop off a cliff, and now you're storing 5x as much data for increasingly questionable benefit.
Re:Hacker, Hack Thyself
by codinghorror on Friday June 02, 2017 @03:07PM
(#14472532)
the problem is once you get to 10+ char passwords the common password list gets really tiny
> Users cannot use any password matching a blacklist of the 10,000 most commonly used passwords.