"I understand the intent of providing a black list of passwords users should not use. However, I think the larger problem is that passwords are a poor choice of authentication and we are stuck with it," says Chris Morales, head of security analytics at Vectra.