Where to obtain a common/weak password list (black list)?

Question

The NIST 800-63B publication specifies recommendations regarding memorized secrets (passwords)

https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver specifically section "5.1.1 Memorized Secrets"

When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised.

and Appendix A. A.3 Complexity

it is recommended that passwords chosen by users be compared against a “black list” of unacceptable passwords.

Where should the Verifier get such list? How and how often this black list is supposed to be updated? If NIST doesn't provide such list, how can I be sure that the list downloaded from some source is nearly acceptable for use?

Answer 1

Well, you could just google it! This is the top 100,000 broken passwords from the UK's National Cyber Security Centre (GCHQ). It's probably trustworthy. Top password is 123456. Probably shouldn't use it then. That article is dated 21 April 2019, which is a while ago. Not sure when updates will happen, but again, more googling...

Your note could also refer to an internal list of compromises only known to a particular organisation. Companies try not to publicise such breaches if possible/legal, but clearly they happen so lists could be compiled.