10,000 is probably going to be the largest number of guesses needed, and if you have prior knowledge, like a distributed set of ssns from the same year and loca

10,000 is probably going to be the largest number of guesses needed, and if you have prior knowledge, like a distributed set of ssns from the same year and location, you can reduce the practical effective number of guesses to a few dozen. The freely available databases of pii in the wild can be used to infer anything missing from releases like this, and that stuff can be used to inform probabilistic password guesses, and so on. It's only a matter of time before deep learning models make most common password based security measures completely transparent and obsolete.