This makes no sense to me (hence the thread bump), once a password is known to have been cracked (or found in plaintext) it is significantly less secure. This represents a huge decrease in entropy even with very forgiving assumptions:
- a random 10-character password, even with a very limited character set (strawman example of only lower-case letters: Pr = 1/26^10 = 1/1.4e14)
- a password that is known to appear in the HIBP list (Pr = 1/5e8)
the minute someone else used it and it was also breached and/or decoded - crucial difference.
What is the practical problem with preventing a password that has only appeared in 1 list? As a user it’s definitely something I’d like to know about so I can avoid using that password again. As a site administrator I don’t want my users using compromised passwords. This seems to be well worth the usability tradeoff.