Having 100k possible passwords and locking my account after 3 failed attempts does a pretty good job protecting a single account from being brute-forced, but yo

Having 100k possible passwords and locking my account after 3 failed attempts does a pretty good job protecting a single account from being brute-forced, but you can still brute force access to some accounts if you can guess enough usernames.