Originally Posted By: Arney
For example, at work, our ability to log in will lock out for 12 hours after three unsuccessful log in attempts. So, as far as keeping out someone trying to remotely connect to my work network and trying to guess my password, even a single, randomly chosen word (i.e. no particular association to me, like a hobby, pet name, etc. and isn't dumb like "password" or "asdf") is pretty much secure against that. An attacker is better off using some other method to get in.


In my previous line of work, I had a nice little sideline in password cracking as part of a security assessment. As I'm sure I've mentioned before, I never did any security assessment work without a signed letter of authorization from the appropriate parties.

Anyway, there are some systems out there where the hashed passwords cannot be extracted to run attacks against them by an unprivileged attacker. But there aren't very many grin.