Yes, but that is if someone is looking at it. It is not easy for them to script if they stole a database of accounts and passwords. I am under the impression

Yes, but that is if someone is looking at it. It is not easy for them to script if they stole a database of accounts and passwords. I am under the impression direct, targeted attacks are pretty rare, and that most of the purpose of a password is to prevent wide-spread automated attacks.