Comment Re: There we go again (Score 1) 383
And as I've had to state over and over again (and this isn't meant against you wagnerrp), my statement about rate limiting, etc. was in the context of a post that did not mention an attacker already having compromised the system and having a DB dump with all the password hashes. That is a completely distinct scenario than the one I referred to and obviously would require other mitigations.
B u l l s h i t
I've never understood why passwords can't be sentences, like "I'm going to take my dog, Spot, to the park today."
They can be, but it would be incredibly stupid to use something like that. A dictionary attack would crack that password in seconds.
What I do is have a single, strong password that I have stored only in my brain and all other passwords are hashed on-the-fly from that and the domain or name of whatever I need the password for. I get unique, strong password for everything, but only have to remember a single one.
Only if you're dumb enough to let authentication program be suspceptible to such an attack. Dictionary attacks can be trivially defeated by rating limiting tries and after, say, 5 tries not allowing any more attempts for some cooldown period. No attacker is going to bother if they can only have 5 tries every 15 to 20 minutes.
The post you replied to only mentioned "dictionary attack". Dictionary attacks are OFFLINE ATTACKS 99.999999% of the time.