An integration test that creates dummy accounts using every method including SSO and then attempts to bruteforce the password should find “12345678” within an h

An integration test that creates dummy accounts using every method including SSO and then attempts to bruteforce the password should find “12345678” within an hour. I think a test like this would also have found the dropbox and macos bugs that let you login to any account by using an empty password: https://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/ https://techcrunch.com/2011/06/20/dropbox-security-bug-made-... https://arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required/ https://arstechnica.com/information-technology/2017/11/macos... Edit: Oh, the password was "123qweQWE!@#000000000". Technically doable with an efficient password cracker that favors common patterns. zxcvbn’s entropy estimate says it will take 10^10.5 guesses. That’s 1 week at 50k/s. That’s a hell of an integration test for most software. https://lowe.github.io/tryzxcvbn/ https://lowe.github.io/tryzxcvbn/