8 choose 3 = 56 Even sniffing just one login gives a completely practical attack to gain access to your account, even though the attacker doesn't have the full

8 choose 3 = 56 Even sniffing just one login gives a completely practical attack to gain access to your account, even though the attacker doesn't have the full password. They might not be able to do everything the full password would let them do, but its still not exactly acceptable.