> So, as far as password spray is concerned – your password doesn’t matter – as long as it isn’t in the “most common passwords” top 50 list! That's a matter of

> So, as far as password spray is concerned – your password doesn’t matter – as long as it isn’t in the “most common passwords” top 50 list! That's a matter of point of view. Microsoft may not care that users have passwords in the top 1000 list because, say, only 99.9% of the attacks were made with passwords in the top 50 list, but this .01% of users is still at a higher risk of being victim of password spraying than others. I'm worried that this line could be misinterpreted : banning common passwords is still important (and not just the top 50). Also, the line saying that password managers should be used "if you are really nervous" is very weird. Password managers are a good way to apply the given recommendations (except for MFA, of course), and on top of that, they allow you to not have to remember all of these unique passwords. It's even more weird since the major point of the article is that the complexity of the password doesn't matter as much as its uniqueness.