This makes a ton of sense, and yet I can't think of a time I've seen it mentioned in a discussion about passwords. Are there any notable exceptions, where atta

This makes a ton of sense, and yet I can't think of a time I've seen it mentioned in a discussion about passwords. Are there any notable exceptions, where attackers don't have the db, but can probe pretty quickly?