Thanks for reporting this!

Here's the results of me testing the first few dozen passwords on the OWASP list:

How did you test and where exactly? Some Wikimedia site? Which one? Or your own MediaWiki installation? Which version and settings?
Please see https://mediawiki.org/wiki/How_to_report_a_bug - thanks! :)

@IagoQnsi if you are referring to Wikimedia wikis (which I'm going to guess you are per However, because Wikimedia passwords are synced across multiple sites), the password policies are defined in CommonSettings.php

$wgPopularPasswordFile is generated using maintenance/createCommonPasswordCdb.php

Yes, this was on Wikimedia sites. I tested that list of passwords against en.wikipedia, but brief testing indicated that the list was the same on other Wikimedia wikis.

Thank you for those links, I didn't realize Wikimedia's settings files were public. I can't tell what is being used as the input file for createCommonPasswordCdb.php, but I'm guessing it's just a different version of the OWASP list. In CommonSettings.php line 407, it looks like the top 100 passwords from the list are banned for non-privileged passwords (as opposed to no common passwords being banned whatsoever). It must just be that the passwords that were allowed in my testing above weren't in the top 100 on whatever version of the OWASP list being used on Wikimedia.

I guess my suggestions at this point are:

1. Make sure the version of the OWASP list currently in use is a up-to-date/correct copy of the list. I can't figure out where Wikimedia's copy of this list is stored, but it's weird that obvious passwords like "1234" and "baseball" are apparently not in the top 100.
2. Add all Wikimedia site names to the popular password list on all Wikimedia sites (and make sure those passwords are in the top 100). It's unlikely someone would deliberately do this, but it is very weird imho that you can make your password "wikipedia" or "wiktionary" by setting it on a different Wikimedia wiki. The ban list should probably be: wikipedia, wiktionary, wikiquote, wikibooks, wikisource, wikinews, wikiversity, wikispecies, wikidata, commons, wikivoyage.
3. enwiki:WP:STRONGPASS should be corrected to show the real rules for unprivileged users. I will take care of this -- however, I would appreciate if someone could point me to the copy of the OWASP list that Wikimedia is using, so I can update "enwiki:WP:Most common passwords/10000".

https://github.com/wikimedia/mediawiki/blob/master/serialized/commonpasswords.cdb

From commit https://github.com/wikimedia/mediawiki/commit/2d15dcfc3f4bf81552b378ce5003661c1681b38c

Which doesn't say it's from the OWASP common password list, it's from a link that's now dead (I can try and dig up a working link again)

https://en.wikipedia.org/wiki/Wikipedia:Most_common_passwords/10000 was not written by a MediaWiki developer, nor the implementor of that feature and the inclusion of the initial list. It is completely seperate

Password Policies as set on WMF wikis can be seen on https://noc.wikimedia.org/conf/highlight.php?file=CommonSettings.php

Ah, it's https://github.com/danielmiessler/SecLists/blob/fe2b40dd84/Passwords/rockyou.txt?raw=true

As an aside, I just filed T174812: Add a Special:PasswordPolicies page to make some sort of special page so we can see visibly how the policies are being applied to user groups. User parsing of $wgPasswordPolicy isn't a great idea :)

In T174068#3573715, @Reedy wrote:

Which doesn't say it's from the OWASP common password list, it's from a link that's now dead (I can try and dig up a working link again)

Looking further at https://github.com/danielmiessler/SecLists it seems it's some sort of OWASP project...

Anyway, we're not using the "top password list" it's from the rockyou lists - https://gerrit.wikimedia.org/r/#/c/254754/

Many many choices on https://github.com/danielmiessler/SecLists/tree/master/Passwords for sure

AAaand... See also T151425: Enlarge Popular Password File to 100,000 entries and enforce the new minimum in the config

Since I at least know that PasswordCannotBePopular must be enabled (although I don't know what $wgPopularPasswordFile is set to), I could assume that the hardcoded passwords in that function must be banned. And indeed, "" (empty string), "wiki", "mediawiki" and $sitename do appear to be banned. However, because Wikimedia passwords are synced across multiple sites, the $sitename restriction causes weird behavior. I can't set my password to "wikipedia" on Wikipedia, but I can login to, say, Wikivoyage and set it to "wikipedia" there. When I log back into Wikipedia, it'll ask me to change my password, but it won't force me to (I can just leave the page).

T151425#2816835

And also T118774: No way to force a user to change their password if it's invalid

https://github.com/wikimedia/mediawiki/blob/master/includes/password/PasswordPolicyChecks.php#L143

So that is done to some extent... So should ban wikipedia on wikipedia..

			$hardcodedCommonPasswords = [ '', 'wiki', 'mediawiki', $sitename ];
			if ( in_array( $passwordKey, $hardcodedCommonPasswords ) ) {
				$status->error( 'passwordtoopopular' );
				return $status;
			}