meh. enabling any of the (fully local) complexity rules pretty much had the same practical effect of checking against a leak. if the password have decent entro

meh. enabling any of the (fully local) complexity rules pretty much had the same practical effect of checking against a leak. if the password have decent entropy, it won't be in the top 1000 of the leaks so not used in blond brute force like this.