> However, I got a lot of feedback from V1 along the lines of "simply blocking 320M passwords is a usability nightmare". Blocking half a billion, even more so.
Because normal humans will only be able to generate so many passwords on their own before they give up.
He also later makes the example of understanding the frequency matters — abc123 is mathematically equivalently bad to mno678, except one is far more likely than the other.
What, why?