[thomasahle]

One in thousand means the user is very unlikely to run into this event.

"But it's much more likely than running into a true positive" you might say.

Actually not, since the user runs into a true positive exactly when they choose a very common password. It's not random. If they only choose bad passwords they'll run into true positives evey single time.

On the other hand, that there exist more false positives than true ones is actually great, since this means you can't recreate the true set of passwords given the Bloom filter.