No, clearly most people don't pick their passwords from a 10k wordlist. My argument doesn't rely on them doing that: my argument relies on them picking bad pass

No, clearly most people don't pick their passwords from a 10k wordlist. My argument doesn't rely on them doing that: my argument relies on them picking bad passwords. I am using 10k wordlist diceware-style passwords only as an entropy estimation of a pretty good password.