You can’t really know if this is “badly implemented” unless you know the motivation behind it. It does exactly what it is supposed to do, prevent those passwords from being used by users. Perhaps it could be bypassed if the same checks aren’t done on the server, but that would have to be intentional.

The password blacklist doesn’t constitute bad password security. Client-side script implementing the blacklist probably gives an opportunity to bypass the check, but that will only result in a lousy password of those who makes the effort.

This is a non-issue.

It is not a non-issue. The implementation is silly, and ineffective, and it is very worrying that a site such as Twitter, where accounts are forever under attack, should be so lax in their password requirements.

1) Why let the world see the list in the first place?
2) “Password” (and variations such as passw0rd) should be banned *completely* on all sites.
3) The use of the word “Twitter” and variations as part of password should be banned *completely* on that site.
4) To reassure users that “password1234” is a “strong” password is dangerous for the end user and encourages very bad practice – the very fact that the word “password” is included should immediately flag the password as dangerous.
4) Spaces are not accepted – bad.
5) The minimum number of characters required is only 6 – bad.