News for hackers. Stuff that matters.
Re:The Top 50 Gawker Media Passwords by RickHull on Wednesday December 15, 2010 @03:58PM (#2009749)
> What if sites blocked passwords that have been used more than twice already?

"I'm sorry, another user on this system is already using the password you have submitted. Please choose a different one."

That's not the sort of information you want to be leaking.

Re:The Top 50 Gawker Media Passwords by rimantas on Wednesday December 15, 2010 @04:19PM (#2009840)
"Your password is too weak"
Re:The Top 50 Gawker Media Passwords by RickHull on Wednesday December 15, 2010 @10:15PM (#2010981)
Yes, this would suffice. But I think it points out that a duplicate password is just a proxy for a weak password: strong passwords tend to be locally unique.

If you are going to have a strength requirement, then run your strength validation routine and deny weak passwords. That a password is duplicated seems like a special case of weakness that is not worth checking for.

i.e. You probably don't want special checks for 'password' or '123456' either, since your strength validation routine should catch these.

Re:The Top 50 Gawker Media Passwords by jberryman on Wednesday December 15, 2010 @05:10PM (#2010032)
Mot to mention storing the passwords in plaintext (or unsalted) to be able to query them.