Real users have passwords that are simple mutations from passwords they used elsewhere. They'll change a 1 to a 2 to make it unique and safe, or change an o to

Real users have passwords that are simple mutations from passwords they used elsewhere. They'll change a 1 to a 2 to make it unique and safe, or change an o to a 0 to fulfill the next site's requirements. I don't buy the idea that being typo tolerant only helps the real account owner if it's also opaquely increasing the amount of password reuse across sites. Not to mention that the code handling the typo comparison is a pretty large new surface area for attack, all in the name of optimizing the experience for typing passwords by hand (a practice we should actively reduce).