[Aloisius]

Instead of banning them, it should simply inform the user:

"Your password is used by 1.2 million other people and can be easily guessed"