>only 5 of the top 25 passwords are 10 characters, so if we require 10 character passwords, we've already reduced our exposure to the most common passwords by 8

>only 5 of the top 25 passwords are 10 characters, so if we require 10 character passwords, we've already reduced our exposure to the most common passwords by 80%. That's not an accurate measure. Like, take two of the example common passwords: 123456789 and 1234567890. What do you bet that the people who'd pick the first would pick the second if they had to use 10 characters? Plus, attackers don't have to try passwords that fail your requirements.