> That means that each time it is gathered by an attacker it gets easier to compromise. I don't think this is relevant. You still need to inverse the key-deriv

> That means that each time it is gathered by an attacker it gets easier to compromise. I don't think this is relevant. You still need to inverse the key-derivation function. If you know a hundred passwords, this will be technically easier than if you know one password, but it should not matter if the security margin of the key-derivation function is high enough.