That's easy to work around - use google2, google3, etc as the keyword. A more "industrial" implementation might actually store secure hashes of past/void passwo

That's easy to work around - use google2, google3, etc as the keyword. A more "industrial" implementation might actually store secure hashes of past/void passwords and increment a nonce until we get a "new" one. The underlying crypto is still sound.