After pondering this a bit longer, it does bring up some relevant issues.
-
What about other languages? Surely “monkey1234” or even “password” itself is not a common password in languages other than English?
-
What about languages with ideograms, where one character is an entire word. Where
is roughly equivalent to “correct horse battery staple” in English.
So perhaps the case here is stronger than I thought for making this file dynamic so it can be loaded per language at a minimum @neil? That also opens the door to “we want to make 6 chars the minimum password, even if we know the risks are dire?”