kinda hoping "testing weak passwords on your existing user's passwords" becomes standard practice at some point.