Unfortunately, if someone wants to share passwords, three minutes is plenty of time to do so. While allow lists have some drawbacks, they are the only way I'm aware of to address this.