As someone who reads hackernews and works on security systems, yes, absolutely. Run their passwords through haveibeenpwned and disallow anything that shows up.

As someone who reads hackernews and works on security systems, yes, absolutely. Run their passwords through haveibeenpwned and disallow anything that shows up. Based on the feedback I hear from my non-tech friends and family, not allowing them to use their single password used for everything would be a good way to exclude those folks from using whatever service you're trying to sell them.