Pwned Passwords in Practice: Real World Examples of Blocking the Worst Passwords
Stupid question here.  But shouldn't websites/apps simply lock the account for 5 minutes after 3 bad password attempts?  --  basically ending the usefulness of bad password lists, etc etc. Do sites actually let you run limitless password attempts -- thus really find these password lists important? If your password was "foofoo", and there was a password lock after 3 attempts I don't see how you would crack it with a password file (in this lifetime).