> Most decent and important sites would throttle the number login attempts one can try before at least throwing up a captcha or outright blocking. The types of

> Most decent and important sites would throttle the number login attempts one can try before at least throwing up a captcha or outright blocking. The types of attacks discussed in the article are not feasible when the only way to try a guess is to send an HTTP request. Look at how many guesses per second those GPUs are doing. You won't get anywhere near that sending HTTP requests. Passwords are far, far more likely to be cracked if the database of hashed passwords is compromised. That's what you should really be worried about, and it's the main reason to use strong passwords. Also be sure not to reuse passwords, even strong ones. A strong password can still be compromised, because there are many types of attacks that have nothing to do with cracking hashes.