> How do you prevent someone just constantly brute forcing the password? Unless they are morons, they will use some sort of key derivation step, probably on th

> How do you prevent someone just constantly brute forcing the password? Unless they are morons, they will use some sort of key derivation step, probably on the client side, that is relatively expensive to compute and produces a key of a size that is completely impossible to brute force. That key is the actual "password" verified during authentication. If done on the client side as I suspect, the parameters for this step could be chosen to take up to multiple seconds of compute time, thus making even simple passwords effectively immune to being brute forced in turn. I doubt you'll get much hard evidence as to which measures are being used, but the above is pretty much guaranteed.