This question already has an answer here:
- Banning specific passwords? 2 answers
Suggestions to make a good password all focus on creating a string that a computer (or more likely, a network of computers with multiple GPUs) can not guess. Putting a password meter for when users create passwords can help against this a little, e.g. by enforcing a password at least 8 characters long with a mix of cases, letters, numbers, and symbols. But password meters and rules can't protect against the following passwords, which all look pretty good:
qeadzcwrsfxv1331 Coneyisland9/ n3xtb1gth1ng, Oscar+emmy2. ":LOL1313le Sh1a-labe0uf, DG091101%
All of these passwords were cracked quickly for this article on Ars Technica. It seems impossible to compete with the complexity, creativity, speed, and comprehensiveness of cracking algorithms.
So here is my question. If, in theory, a few hundred crackers used their hardware and cracking programs to generate a massive list of all of their guesses--and they continued adding to it, so that the list would include any new guesses likely to be folded into cracking programs (e.g. say another site gets hacked, all the leaked passwords would go into the blacklist), would this be feasibly useful as a secure password generation tool? Or would it be easily circumventable or does it have some massive problem I'm not seeing?
Since this massive blacklist would probably have to be crowdsourced, and therefore available to crackers, and potentially even something that crackers could add to, are there ways it could be used to a cracker's advantage? Or would using this list make their job harder no matter what?
Any other reasons why it wouldn't be useful?