Tell me more ×  The question Should we disallow common passwords
like “password” and “12345”? on User Experience immediately made
me think that these common passwords were extremely dangerous
not because they are weak but because they are common.  Rather
to my dismay the security side of the argument seems focused on
but if you ban them, users will use other weak passwords which
is a partially valid argument, but surely actually using one of
the most common passwords on lists like 25 Worst Passwords are
significantly more at risk simply because they are common rather
than the actual time it would take a brute force hack to guess
them, right?  Is it realistic to assume attacks will focus on
common passwords before brute force? In a world of rate-limited
password entries and captchas, it seems likely that you'll only
get 1-3 guesses at a password; guessing all 5 letter
combinations isn't feasible, but guessing "password", "123456"
and "qwerty" seems like a valid possiblity.  share|improve this
question add comm