This is a well studied area and never a surprise. What I haven't seen is a list of common passphrases or common android swipe patterns or common iphone PINs. Is anyone working on this stuff?

Its also 100% shameful that I can't just shove this list into Active Directory and deny these passwords to end users. I can turn on complexity or length, but nothing else. So today's "password" will be tomorrow's "tobeornottobe" once we all migrate to passphrases/12+ minimum character passwords.

Also this is blogspam citing other blogspam. The source is SplashData and they release this analysis every year.