I was wondering this as I read it as well. Yes, we know it would be fairly easy to compromise an individual account by guessing common passwords. But that assumes you have one particular account in mind. If you're just looking for bank accounts to access, you first need a list of usernames to try (ideally usernames of non-tech-savvy people) and then you need to run your entire password guessing routine for each one.
I'm no security expert, but I start to wonder if the "practical" entropy of a given password is actually much higher than the theoretical entropy numbers people derive.
Serious question: when is the last time anyone has had an account compromised because of a weak password?
My wife had an account hacked years ago. I don't know for sure that it was brute forced (could have been phished or exfiltrated by a keylogger or session jacked with an XSS vulnerability or...), but I also don't know that it wasn't brute forced. She used very short, simple passwords at the time.
Come to think of it, I also had an old account with a very weak password that I hadn't used in years mysteriously hacked one day. The language settings were changed to Russian when I went to reset my password. The fact that no other account of mine appeared to be compromised and I hadn't used the site in years certainly suggests brute forcing.
>Serious question: when is the last time anyone has had an account compromised because of a weak password?
What is your definition of "weak"? I sometimes help my landlord fix their computer when they accumulate too much malware. One time I brought their tower home to do this and didn't get their Windows account password. Instead of calling them I decided to try a few things first, including their kids' names. Lo and behold, the second attempt was correct.
Brute forcing a weak password probably isn't what you have to worry about when it comes to targeted attacks against weak passwords, but social engineering is.
And then what? Like sure, you'll be compromised on that one service and that's bad, but it's not anywhere near as bad as re-using passwords across services. My argument is we should be focusing on stopping password re-use far, far more than we should be nit-picking about password entropy.
Hah, funny you ask. I was able to siphon off internet quota in my college using a combo of brute-forcing and previously known passwords. Worked quite good until my conscience got the better of me.
I'm no security expert, but I start to wonder if the "practical" entropy of a given password is actually much higher than the theoretical entropy numbers people derive.
Serious question: when is the last time anyone has had an account compromised because of a weak password?