2 comments

[ 5.8 ms ] story [ 14.7 ms ] thread
I seriously dislike systems like this.

You make it super easy for people brute forcing your passwords to limit the scope of things that need to be checked. You remove a extremely large pool of passwords that need to be checked.

I don't see a provlem with blocking the top 10k most popular passwords